e2f254d217435584a391fcfde45b038e38193646efc92d653264002e7eb1539c

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76eb56b761b276e899865bf31f23e25a_JaffaCakes118.html
Size

27KB
MD5

76eb56b761b276e899865bf31f23e25a
SHA1

1db8b09f7316142161fe44e1bfa8387dfcfe512e
SHA256

e2f254d217435584a391fcfde45b038e38193646efc92d653264002e7eb1539c
SHA512

ea9bd5da028052b5879c35566649acd7312684c536593f958fb3ac18ce5fce770dc4d394d286a45f0c9db29b8981ab389e2a7e1fcb6585d2709ad7ce8bd9334f
SSDEEP

192:uwkS6jGa8fLqb5nX3yGeK7PU3NaHbunQjxn5Q/h+nQieFhNnvponQOkEntDIWJnr:0Q/MSpGV+Sx9

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422922612"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2ACAAD51-1BAB-11EF-8ECF-42D431E39B11} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1660	iexplore.exe
1660	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 3004	1660	iexplore.exe	28
PID 1660 wrote to memory of 3004	1660	iexplore.exe	28
PID 1660 wrote to memory of 3004	1660	iexplore.exe	28
PID 1660 wrote to memory of 3004	1660	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76eb56b761b276e899865bf31f23e25a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1660 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa60b6cfdf187271350c87100fc3da8c

SHA1
bbcbf92e5a89ff3ea72edefa06948248697dcb52

SHA256
42476b6abeb8985113b493c3f38cf3930672df16e86b7e4c2bfe89dc3d456f17

SHA512
c0549069cf713d0d4251633b2d4a2e1bc1ba34519e5af16f1e1d9f1de8d8d6da13ede170123f67a10ad05ceed70b83c97e24cca8a33b10af418974be3fbe49a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0567303b02a781dfca4894e5a5778e82

SHA1
663e570b5b265734ff1283f847f9ffe8174aa4d4

SHA256
6b1d1360aec40421825c3d2055451c8dde1256fdb323a9069f52eeabcadf5fe7

SHA512
e20228e242699209a84fb761f21b9382ab97d6fc369982d494d39774cb91c6f053704e99cb2d91cba2dbedaf37d23bbfcda00b2c739f6ab4e71b593f520e1209

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3c8e8b979c1d4088e68748c1da9c8004

SHA1
151c424a1ebf2b868f3d09a31bb3f34861d5ecaa

SHA256
08f346f3d821b9052a8fc21cd663c3cb0a9787ee9fa6da98037eb45ae28fbd08

SHA512
21a19e2827eaeb6ac5f4d8ad29a6223fc7f725bcd9778141f6f1de08987e92ec27198cbca40c08bd77273b513c0b36b222e1d5f68126c4d9be4f467c346fe477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6c48babefed1e4b545f8342b1d73ca79

SHA1
80e273555d840f6a5f35a5412931c46cf9af51ed

SHA256
0b3b0740374fa71cba7f0be33f2bd0effbecf76a6dd4aecd3ce830aab6c29761

SHA512
541c17a310ce2c3dadb5c5fb88b0a1325fe7a948a00e548ced3da02900dd6d2b1425d04dc8b45607b8db1a23afbc4f0eed1b7c043701f370de13c4fbaacd495c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1cf8129638d36790e175cd0bfbbeffeb

SHA1
902cc1799f1457a9ab71f52c848e9f17aa6cc63b

SHA256
9b27a2300d4151125f0ca64d45b252b1d560d6baf82806f869f061c3bdd55205

SHA512
04445157515ae60c1b618b98c36d9c7b169d99af7e77aa16259ca0936a44b3bcba40fb2bd28544c56cc618b82f1c2587f484928070ac1cdc50e57ed08bc97e3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2fb3d1adb2dfae3163c38663a31ab32a

SHA1
552a85097f74d7fe72a794bbc0cdfb674d269b2a

SHA256
3d98082daad657b35d1b07dbc9ca1a2ac0cfa3ffd6fdec5ebcf94b81b911a785

SHA512
8e9f49216770285a26385b5adc5d9ff57acbb72ce8aa26efaf2229ec492a9b211e1482aa54c4999cfb8630599cce3d653ee09531e6a3e60aa36d1f6cbb52762b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b5e5bf09d1bbfdf6bfcc6b7a33d21f1

SHA1
1dafe9fa50216b91f1da930245f586dbfe8cb2d3

SHA256
8cdac0ba7de040002ba14c235f6ac939dea4996584e90fe0663150c76f9efc7b

SHA512
a85e25a70b634a244042413f4c6de1f7f46c6de0ed0c78181d13c7e90b5269c9e317504f88463efc7611e9b0a6b840471164e610dde7bd2e3a68e791bd7af7ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c830618e7a8af85a90bac86be77f9fa7

SHA1
87aa5aa7acd1dd0b4cde8f0e5257ad9f980dc6d0

SHA256
6945d6a4957ec88f13cac5ae781f96b914314eb90340a45e517e31f3bcd9845d

SHA512
60c390419ed1deeadc1551d2220633056a81c69b57407478e60a14211e0b03e96c2527abda32e6b084dae372a343f7f1d91d53eff0208812e30b9dcb78f26e82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd3b77e95b216065a079a52124bc3925

SHA1
6090c880676416f467c1131e4b6d3c4c4a7dfd44

SHA256
400213eb8794dff828ee94804bbd564a8b07a5c0d3f89b3374f65471d6162cb6

SHA512
2b8c5cf57ea000fffe65106c8d1f7904ae2f4f9330ddb1e93afce702df84a0edb3560c4a64e5c72284e350c9d474202d750e6072ba5e4831b3fca85338a1d2da

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA20.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAD3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit