e6dda1f80855b51d648f6033704ade894dd0026462ff4e34e50ba87527afa0e1

Analysis

max time kernel
149s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

75bb55ace2e8e470ffa4bc2e3848b168_JaffaCakes118.html
Size

34KB
MD5

75bb55ace2e8e470ffa4bc2e3848b168
SHA1

8d480d50da37d75978513c04ebc1e715a13c4dc0
SHA256

e6dda1f80855b51d648f6033704ade894dd0026462ff4e34e50ba87527afa0e1
SHA512

8b8e08a05c21eb4b40b41c3a394871f92dca4be2cddf9f6a4c6352100f67a9954b87c7e6eaff0b588d5d85db367e2e9bbb3485141fe108f8ef87b2979bd18633
SSDEEP

192:uwDNb5nbSnQjxn5Q/anQieBNnbnQOkEntqcnQTbnFnQOg8cwqYtcwqYFcwqYQlTq:DQ/0Ax35lTH6zJiko/vc

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422894319"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4ADB9011-1B69-11EF-8A7C-66DD11CD6629} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1904	iexplore.exe
1904	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2936	1904	iexplore.exe	28
PID 1904 wrote to memory of 2936	1904	iexplore.exe	28
PID 1904 wrote to memory of 2936	1904	iexplore.exe	28
PID 1904 wrote to memory of 2936	1904	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75bb55ace2e8e470ffa4bc2e3848b168_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e78f10e31228de0f750ed11b5bcc0142

SHA1
dc12fb5c4f2e6cfc28810899a9a8965dc0c5e9fe

SHA256
57514a935cfd90fa6273b9b3996a007e7fba083854e05d97aeaa6d3e225dec5c

SHA512
2a26d8718d7bd9a32b0bfd40d11219cf3f2e014107f5e6fe3a948f64a6dd6d0e463bebd093b5587ec1917e684eea2dfc67d74d66c82919d8a1738a24c5e74ba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba4d6bda65f30c3d39d6a6e02a524b46

SHA1
fdcea4331be2b16168cd9d8b2a3dd3c4e71423c3

SHA256
5baf385b41deecefd871570ba0028d7461aac7778656167a3240b0aaa021d42e

SHA512
1528ca03fdf40768773fdb049647fb20c60f79dc94de5ce854bf393d95e33f8452c9b2831953b15ad3260b00239b4e580f3aed55044c25ac7a0c5d833b9f4626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0d7aee477072a561ec3be46ca59f1f0f

SHA1
224aa34486b8e298b6bf4d94f10741d0932bb7a3

SHA256
9d21f7a6028d9ebe725b4b40194622620c12ee474b31f9fbaa1ed27a58d2a256

SHA512
51dbfd22e0e4bb1f5c95e409f1b951154424b8464b22d654d510dd7ec075a2768f8a518bf280afcf6519787fa7e9991b507aef007f69db61af6cdbf4bf08f3f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6190a1cb3cf8df069fc8522cf9eb153a

SHA1
ef72b7c6e05c72975b18481a98473cf1ceb0f843

SHA256
eb46d93fedf7e7d2ce0ef15c48db460468159ce2064016014fc503e47b9298dd

SHA512
cd38278789881e33105c8bfc9fae9abf22dc6d5dde0a2a280d312d632e002c010f92aa962030f459817e0c6d746aa375855365e40f1333fbb2d55581cdfc2e32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84eef2b86f7ee56102b1826c331884dd

SHA1
72c87fc862b683f86b7256e538f6314f0eca7b1c

SHA256
c5ff3c2957302e9cb00c02170148e479beb7880938ad625a6c1f24f5107d16f7

SHA512
771e7bda2957beab86e96a4fc5bb81ab436327b20f66b15a2aff388084c539825c1eca572cf8c6030bffc10dfaf737fc8cbb44e4291ac3c6ef5ebd4930222cba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a89530122c6e44a20e04af7a3afb8ed

SHA1
4a4630bb5c0d6f778285bd6c3d2915aa2f4bd2e6

SHA256
f4ffe1947ea0d49fb01fca6464bf0d56a7624cc5fb0a9eb995b021ef413acb5d

SHA512
b316f1c1eca18dfbc6c3a3d9aa3f7bd857be2177d4a2fea275fbd6622464922ced86e91f559da1939c4dd024f2d0fbcd38cf2ca6f1fe61a2a9c52eeb099d0c5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9925ee2ad39fce698302621cc73cf38

SHA1
17ca6369df4e26668eff2919e9284dd4cfa4b5a2

SHA256
41667529e9ceb852e764a510ee66d36f83ca58b98f6e69976126964e2bcadc95

SHA512
cf1b59a2397dfca44d9cece47c4cfdaf7d978152d129e49cc22f131c6f62e06a6a336e9c4b3945b41496939f9ab6d1f7786c7b8b305f04c7624b8efd55a9a037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4eb16bce59121c22dcb93b6c4a1cf19f

SHA1
432086c21e7748ea498871265bb6aa77a429c6d4

SHA256
ba31d84c08fe0fb59fc61968700ff270523a230517b48c48f4c4e6b40066072f

SHA512
f22ba134c36eb616be834743d76dea11a8e9c065aca6eca2987595b4b0d6b49c4ff2b201ab81e764d83944de7f0b856973a22200f387e05afd9c8a32756b1fd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f10c14191775a32c358345d63afa0091

SHA1
10d1a46c7fdd8212e125bfd7b3246d7d6a29c10c

SHA256
78a542814083db2c284d8e37bcf961171941d6013ee79ffa17389228ab6e08b3

SHA512
673830e74cb2f2ced7f4832bde4174ba9dfd84f7336b0c8de2cc4682003cb2fbc17709d2cc20abef71c072e594c9dc9a3938bf5151ac893d3751d2bfe3960744

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA9D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB8E.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit