78ebf0b082e6d5a2616b8d881c095b1065d633237805d542a90988c05ed9f3b3

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76e59b97fe71552843ed27b8bee2c7c0_JaffaCakes118.html
Size

106KB
MD5

76e59b97fe71552843ed27b8bee2c7c0
SHA1

35084761c6021693dd917620fb1d0fece515f54a
SHA256

78ebf0b082e6d5a2616b8d881c095b1065d633237805d542a90988c05ed9f3b3
SHA512

0dfa8b37cfe9042870a2edbd509337b8a297f08d0d44045d8e60339926fdbb7b5045704aa10ac3fd6d405dbaac650729eb53f3508eb968fe525eab562bb75eb6
SSDEEP

1536:q+0gTkiGZbY6DJaJyFk5TUdRExwDMX5RpKzCRSRop6/P1kUUxti02:XT/lt5wRzBUxtd2

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{16196501-1BAA-11EF-9201-6EAD7206CC74} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422922149"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1524	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1524	iexplore.exe
1524	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 3064	1524	iexplore.exe	28
PID 1524 wrote to memory of 3064	1524	iexplore.exe	28
PID 1524 wrote to memory of 3064	1524	iexplore.exe	28
PID 1524 wrote to memory of 3064	1524	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76e59b97fe71552843ed27b8bee2c7c0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1524 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c376a4bfc37a555036e3d61ae5eaa5c

SHA1
41bc449b40fffc3d4a7be0df14b135b422d9fda8

SHA256
58bff81063dd0505bb682eda6fc25c359d52ffb0ed7efbd46bc80047b00e229e

SHA512
0ac688d15bcfa5f3463649de344d74266cd512460e26aa0fd78004e75d6ea035e2d474d85eef50b779502df7024b21f6e8470eb31816d95a37d73399e0f9e7c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
99bac57cd8fb16b44c112cfa828e542f

SHA1
4bc83f922ef9d741e1c6a06512ecbccae8a513b3

SHA256
750133cc60887886cfafea28d40ab96ccce8e2c6a34a66e58545b62a1e7f1ba2

SHA512
3a7af9c9a0c2ea2b293b061f780d9ae2a34a3078860cbdd2276408855a968e654638ce1734b5783d85bacc73a70e784691e2955c4ab8f13763703bf5124b8deb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
579a6f578165d6864a5c9de190f0791e

SHA1
7b83b447c11bf37652f467c347ce88fd24a1ef2e

SHA256
05cbbe87f60c567ed916136203666b0ee5b07337f00edcf23ae3548bafc9cb33

SHA512
31c16accb3959658cce823f0ceed898d2abf9b5b95771e728080c2ec88b2decec13a4e820a2d01a5181be8ae675ec0224c0fc3ca76b88574f93f694a82bee6b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c98808217985b49c9a6cc4f204aecde4

SHA1
e51ca52fa3c5ab1972c7490580be9c0cd7a29f0d

SHA256
05a92a22196c6135857b3d499ddbc3e472fadb8334b57078c0fd9edd360bec5b

SHA512
b65c303f095bbb2a209436283e34547d21958cc9540af3c3fcac6968d0d7d2cbabb62008353448cb6abe03df28fd1bf981a1bcb569b11018aae6315351e83331

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
757608e1103a9fc319b04b673c699db3

SHA1
1b8584326e521de7abed6ea75dcc10fa359a9ca6

SHA256
8a462bdc11ffa6503cab23a2569d0a67bef3abfdaffb69e61c728bce56ebbb20

SHA512
0a06070fa88c124762f7eb186e80359b9adcc3aa5c5afb6781c096f1488aa1261a7af0e86a19ef0fe43a8f29687e13937ee579bce5cbd3b13be70bf97e46bff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b2c142b4dea4177c0a6b96d7e9172ae

SHA1
cddb7971d591b5237f18544c2532dcdbd80c8612

SHA256
202408a45a1088b16f343508f45b440f214b1e5f8b429c52dc6a39cd3c8c3bc4

SHA512
6227a71fea4d0072c6c8bc890165a0fa3953c4ce7fa7d187c0eecfc6a81395d50dd907fed25252254007daa1c7364bea154def9536f327657cdd95d95bd38c9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b800420caa9ce54a9ace4c9bc17163e1

SHA1
b00efea7f1a833be90a234337318d7cc34118e7a

SHA256
9bea1fdb381202942a9d4e64e5a81c853afebe89ba5c37bb0d620f80d60ea4f9

SHA512
0d8ffbc1af84155523fb2938e9fd2fcb3df581ff807d668cedaa34fc02e27390af0bfa69b8b32ae03187abcca793b6c70f72077715f48fba19ced3bd11642a93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0179a117c5f024835c38ef2111ed887b

SHA1
232f47dc663959b8509d8f2702a72c32d4f9fc72

SHA256
c2976dc16d5df43f1dddeaa5de6a0817c29ebde720d17018f98dc62f39bbdcf1

SHA512
fb302ba019409edb41ea2040996c05f39d641743242e297cc346f79324195a342e572ebfe73f1a2e314b199736515708742e6915e288ac854ca1ffb3fdccd681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
565c0f0f66625d8c567646974fbe232c

SHA1
5698d4aa5c2640d42fc138ea5f378b6d6dbca427

SHA256
7a09e218f3a4bbad027d8251d531622ab25900b02591512c297bd86dafb4732a

SHA512
40e1950b9d4a8f64171364fa8abab4123be300d1445c2d6adc93ce9ca8ddc56536dbae40933a6981d0c53ef1bf75f7ff8b33cf57cf2b384a009ee742c066ab9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9221be40f273d938e66a2643d42712a7

SHA1
92ada946ec4102ee0575c6a8fa25869e9378c154

SHA256
91dfa386e72ad2ef38bb840f3e0fb9706be68327a52646d3f3d755201e84f422

SHA512
f3e1cca7c10184454a4fc984b108737a00c3b2cfd9183cfd002048e7e7e665f947d006c9b14fabec675f2ae125e7becae323b7b3cd34825b14ace23720214ff5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6883.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6971.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69A5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit