7b7561a0f2ed01d8f4f676b33bfed8880e3f488fb9e026140c565032e5166b82

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76d6f0e0c6844d23611aab7f5cf9656c_JaffaCakes118.html
Size

18KB
MD5

76d6f0e0c6844d23611aab7f5cf9656c
SHA1

d8b2f3d9d71d7adb92ddb8bc04842ddce0226b60
SHA256

7b7561a0f2ed01d8f4f676b33bfed8880e3f488fb9e026140c565032e5166b82
SHA512

7a26e7de221726882441df73ab7a43939de9815596f609d7046ada4f99e63051d353f42f03001918652e978632b2979312be37e9768be125128be9c7426e6496
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIU4wzUnjBh8m82qDB8:SIMd0I5nvHtsv8lxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{260D31B1-1BA7-11EF-92F7-4AE872E97954} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422920886"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2864	iexplore.exe
2864	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2380	2864	iexplore.exe	28
PID 2864 wrote to memory of 2380	2864	iexplore.exe	28
PID 2864 wrote to memory of 2380	2864	iexplore.exe	28
PID 2864 wrote to memory of 2380	2864	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76d6f0e0c6844d23611aab7f5cf9656c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a216cb470024c702611a8cf5c79d891

SHA1
08714d309f50ce9d7fafc2d24685b83910dfb927

SHA256
ba89caeddfbe9c874dd6f3b70e6a0e7ea90e9a24fccf88cbd75c768e4ffbd8fb

SHA512
6e2e62e12949c10ae45697519b3e115d871f9580bcf66aad9ca2513f9bee0f1bd5403e57c82ff69b5cbfd08d77d5cc5d1913eb5e64fb8891ec6c13337b28fdeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
04fa0ef3478bfbbf55c6eb00e66ae7e2

SHA1
6969f639d183f299ea346ccfb028449baa4692fd

SHA256
b9a61ed29d7ac8b13021473bd8ff1ec5c1027d79fc710b79c229e3193a13b40a

SHA512
a534dfcef4cbfe085b03be2f3a30212973ca2ae51612d2a4bfe86586048054397b764a5214f1b07a8e120f3d8c55722598c01644e4f5178dbca485cc175fba0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5711eeb0b4e6be59100657495a9bc31f

SHA1
906cd2f01a6506472c39a2ffd2fba2aa5369efc7

SHA256
917c777e12b88b3a9d92f29e5123702b91abe0f7fc84f003dd29c1eecacf807b

SHA512
d2d631a10c3945ea6c02b3873d7bcf9aaa6c61e3b5b3c8dee0ef695b6fad65ec2a9dfedd507b150101fea225e2c15ea3318c43d4eb1963746dade3933a25959d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb04478fae0855f8f455fa4ea093f384

SHA1
587286f7efad79b01e0b14351555615715ddbef7

SHA256
f4e5dc975ce79fa93b5c395d9ebd209fde04a3d60c9cfa74f7e3dadfa08cb8a2

SHA512
3ab3b10d13b38d614953b36cb4e778cd3ba0757bbcb018f960f4fef127bf8af8bbfd90b418740a03232979c0231dbfa91208f1206e6046dea6c2abaa3d3ff608

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f2326d52219f320f05d2776071216d3b

SHA1
3856e326a05ffdd3a8ef61c6a24bf8d2d092f98d

SHA256
396cb4486ba65289369d2663aa1db750ff2cc229493e63246008fd32faa2c187

SHA512
cac8961c5104618bd914bbf9710e37cb2eda1c40c521b8728f20b2a53df377c9d7166455f2a05411c500a0267bd9806bc3457f89960219d6d8334f465bd98617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa4fd0678bb7e5b50d0e039e07bb8928

SHA1
374001f7ccdfd52b9d8ea6e396e92a325e30ae5e

SHA256
9f443b6b522014145399c6d0d3722d9250178796f27181ff277163fa5db7a7ee

SHA512
2441e7a7886ab094dd29079eea6c579657a48852876efaf8609172d0c489aa3fb6efdd2c0a4020c6b8195444d7b0eb98498dae8e88c796ca2ab5b17e6b5dbb31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d65aafd260c2899b8cacf1d6a91dd849

SHA1
a5beea21a57b941dbe15158d9954e8c4cfd59456

SHA256
5086311b7e4a24f1699e6f1ea020766342b30268953d3a885a746bfa53d24139

SHA512
de97bb291b5c7f83f9fa726923c96279a962897a2b15a7af030a12c162830166ff0c7228c93a897c67f3f9394e7ac3c0f9f3e9dc4af5c994ac9ba5efbf6e668d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3eea45158631d082878da76c3aaa0bd2

SHA1
323a881e4081c0fd124e8671ad96b78ba4721b00

SHA256
7afc062bb884998044e4f0e897525ebd794a5168f9d50ccc9f626b9bc09c92cf

SHA512
e41e3456f2048ffe6237b4b1d01b190d9e3d2fc49fbe4fec5ecac383136ad3f1b4dc25fc64d74365846a72612388ef14756d7b7f464f8608a6b8934fe655a1af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec0ef9cadbf296621afec30686d1766a

SHA1
0e3ebe7ad5773cdba36f29f0f0192a1973c046f7

SHA256
0bcc98424d4261368094fa699ea7f3b4ef1532ec85dc0f78a1ee6df541ecf64f

SHA512
1d638da710bb0b1a6683eac349981116136e151daf8827f3d3e380eaf2a09843e84c77cf62926debde1a587c342997d47b9c7e2d00a7dbc56578ef204a8c57a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6D4.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7C7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit