35005f2f7d8efe6af79f399df63f9e6b0e3ed4c042bdd30a380a7987ac80a9d8

Analysis

max time kernel
148s
max time network
137s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75ca87e2ba17bf1e3c66aeb683992469_JaffaCakes118.html
Size

19KB
MD5

75ca87e2ba17bf1e3c66aeb683992469
SHA1

2dcab5f9a303e0a271243901acb55b45a7ab7c90
SHA256

35005f2f7d8efe6af79f399df63f9e6b0e3ed4c042bdd30a380a7987ac80a9d8
SHA512

7079f6cf427c8053b66d051aee5ce26a5afa1e53028d86ea0d7fe8e6708f1b1b685e94af89cea178508b4bb1d9115d6003fcae811b8901b5d455ead9c06226bf
SSDEEP

384:SIMd0I5nvHVmq2miQgA4G5iP8svXkPlxDB8:SE2pA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{816E6B91-1B6C-11EF-8C92-6A2211F10352} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422895698"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1960	iexplore.exe
1960	iexplore.exe
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE
3040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 3040	1960	iexplore.exe	28
PID 1960 wrote to memory of 3040	1960	iexplore.exe	28
PID 1960 wrote to memory of 3040	1960	iexplore.exe	28
PID 1960 wrote to memory of 3040	1960	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75ca87e2ba17bf1e3c66aeb683992469_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0076fb05aadafb98fef4548b321bd02c

SHA1
5c9d2ba3dcf7d9fe2c9959cd98e8256c2a1520ce

SHA256
fdf5151e78b5e86cee4e1153e93ca4ee41ed58da4b11f6bc6fc0a3042c6fe94c

SHA512
8f74e9c87c0eeb415ba42dbdf4ad71b3d9324a736eca47c2965b478b42a82bf74702be20bfb2f2547bf65aec24e32160ab95805a40a6dc22b01592454f07176f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
665e6075624b8fb2d4874519b837eb23

SHA1
5446a10093511c1dea8aafd1920b0b0b1886b007

SHA256
fde37141bb12cffbecdf098421f55cf7abc59ed9c00277be747b03ef3d95d708

SHA512
32b1f1f951726e5fa0c94f14669bf9ff35e40e6b330df8b5687a7105ec4d9f86a6bc5268d52cbbe054b160348eee1d19ae6f2aaf1c3b8ca3073acd8b86482e30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7feaf9344181dd911e022a91967f047c

SHA1
33f22c3d013c5deccece020734e2429487fe2205

SHA256
5e9a98276b5c7a9ec475987447ff7a7d4990c2c5186a02279ec7446a4f51d765

SHA512
ffea44a9d2d1dafaf5196d04972d0f668c6ab9a487fc8cf70d5cebffd1b4530652f4ed6310d2ad4d016e88bbaff80abb94a570dd9d1da4dbb712def5662a6cae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
564695dd789fb9055ddeec47db5eb0db

SHA1
0ba8b1b80be2a6e3494c0a25e53c8284c5d2dba5

SHA256
8818fdb145c05d859c495f73e0cfa25d7255926d16c37cd22ff60887bfc4875d

SHA512
5b15ecf4993e29459e9d8a15f1f1b64c585152d94bc9cdbe626a1c13d59a798add50a80e2d6826692c1aec5a00016e71431cd21d5ac06c55a4b55f7f899eeb59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
54f8237ee477be11eeda47e9fbc83994

SHA1
6cc237dead6f731abe0a87dc4e832d9fcb10fe86

SHA256
88eba5791f66e72f43d8869dcf4a870f31889ca3d735760427f819c107520acd

SHA512
68a57564b992f958c6fa65495eae69fd802ad4bdc31b97441ee1b7b7491e12420eaedc05ae3d82c0c61c64a60cc005c3784d6f7e1e10c4e858a1a8d087d5a676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4de310056645ee558e698a81a896fd81

SHA1
ec9c426e60d76189898f4b38917c6d156763f750

SHA256
6506651d61ef741c93a82d95e01c5d468cb1cbaecb2566382d9ec471b3e573c5

SHA512
0b7a6eee40d5b41e63e341751fa1d2b1051355c03735a0d0b59b8b4d22b7c76d1edb1b88867961a0973ec36c4a9da972e05e21cf2b520b6ad4ecd7420c1f20e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
716ea3b45b746b4a2ae240ccc1db406e

SHA1
7c2c6d0ad249cae24e79df5b8381dde794c64c6d

SHA256
c0d2f1926e6e9cac3f24b36753ca653ece5e7d0271698569592f1661f00e4572

SHA512
b4a18bca5d7dbd3291173dd13f18ad327bf36376a9b17a741e4e2e0af9f5b187e6f4036548933c3fa5d180d3a85ff694e385c9b4316142746a0f5c4df34e26aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5758eeaab6a347b96c517f4da52e3a0

SHA1
6874f8993fbe3b22916b4df289937a36180676eb

SHA256
e7973dd289714984a5e1cc01fb82900a4d5024ce5c9ff450171fd992276a1d4a

SHA512
1e25de161a458f934d93ec2449a76cfc92a2637c91699242c5e5bdbdbeb2ee8837874f40c2ef8fb615511650d29ef42e2744223ecd6f31c722b43a3ff593ed25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21fd087daa5f8eae52b5eb9c961815c9

SHA1
b271fcb5e2478f15bc84bc52cfdb8d5655324768

SHA256
b41af5fb1cff01fc812c88b383e09d8d2a60a2fd603e198b8e28c2af12500265

SHA512
e44665b21c22fd9d64637f545e93b0b597f74caf70c51e8fc712af2ed39afbb1cf88a59e5d3cd33e8f5f2998eb267997fc81a4931d05b78ee6a5433ef3dae030

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab22EE.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar232F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit