a90d8540d882aa895a016eca2b6b8e6217ee2624727053b03abcf37b44e24ed8

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75f4e56143a62791366fb5da40671064_JaffaCakes118.html
Size

18KB
MD5

75f4e56143a62791366fb5da40671064
SHA1

6d03c1d6a252b8b14db18be967d8853e806b4a91
SHA256

a90d8540d882aa895a016eca2b6b8e6217ee2624727053b03abcf37b44e24ed8
SHA512

c995aa5e1ab9c8313825b703cb67db4b8d2068e452b3df667d2fa1f30dbc7cd984bffd154979f3b35ad9ee90e129f6d2d14b420a62b425013d17684cfbd085c3
SSDEEP

384:SIMd0I5nO9HbV4bhV4bFV4bFV4bXV4bZV4b7V4b7V4b7V4bNV4bTV4bOV4bFV4bY:SE9V4bhV4bFV4bFV4bXV4bZV4b7V4b7/

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{188486A1-1B76-11EF-9EA5-C6F68EB94A83} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422899818"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2540	2700	iexplore.exe	28
PID 2700 wrote to memory of 2540	2700	iexplore.exe	28
PID 2700 wrote to memory of 2540	2700	iexplore.exe	28
PID 2700 wrote to memory of 2540	2700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75f4e56143a62791366fb5da40671064_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cac35e64bda5f0a72fd71062788b21ae

SHA1
2025d47d2a74891ed87dd5653aae7e1dbb424714

SHA256
010b867d3c189434130e00cd9886fa999541182d3cea4a5fd8ab0b86c5ca3f0c

SHA512
72347bf9bcf17d081dd2a6bcd2fa4bfe66568c518f4d67e3c782b809a6bae4649e9b1407bb04b4f24acc1d74c62ad24fc3273d15933513e1e85a7cb7dbf0e6a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
468d12aa270ff217b020aba2a4e7a7bc

SHA1
b8773d461003f8ba30e1e7fb06690f94a05f5cc2

SHA256
e70d2e7127cdbef2d79865697d08e0647e1a58d728eaf83778cdac744f859ea1

SHA512
171fa014d00ee08824db71a5b26ee623e1f8fcfd0fd0573a976b54172c7ff3c089b0e15b1b25488a3b07ab91413a3fc5720ba0e0eb337734e4a23a9a476caf6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9e179f0890ea11520a9fe4338fd1d379

SHA1
b63b1b17b7481195d5061d67cb96073b8942af0a

SHA256
c99e108b8a42d27e8ac8cebdece031bc57088a2547a5dfe0c5f692f54b820421

SHA512
75b43115f4c00a72e6ac6cfa3af651a0b3911796a3428acd19b2f7f35fdce1e89e9988be7996b15d5352c2a838211f38d5324521df293557954e76cc408b733b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dfe529d0088fcb275ec7a6ef7ffbe7fb

SHA1
261ff40550c4b44eac13f0a579d22ab51b32ff1e

SHA256
acd694be484cda8dca573048005a67dee340dd570e3b494cdd0608246fae0c1f

SHA512
1db7b7197be3e957c8547e6cce74dc1ba33f55891d3eb34b80190a0796913abb5c5d7d1299a18033e951a42c8ac68497d36339c0164c653d642b10c51e7797d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
36f3bcce8702a9c06e100754546f7d79

SHA1
b0323e2088c418924369f1bc795d593dbab847bf

SHA256
ddc1e9a066d24eb53b223925ceef2cef06257ed478a57f4651b1edec65d70098

SHA512
5c3d6754bb16209b4cdea654783b4839436cf2ecee092c57c25be1bc7aab205ca0c10e2ca7e930adfc0acca59a26c7d17a0e515a1e30623c0b41b2774349bb8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f213377ba2a88c3f0f2f07329c6dc590

SHA1
1a659044d1451e92cfdeee18b561d1d1564bff19

SHA256
897a04385ea2edc5818410458c0223bec67277955aac205947782c9aafce46c2

SHA512
b56dfcd8b03957e36190bd8b46e4eeb1cd37a6621ed797f972577dfe6adb42f95ac36cd1d478728964d2be9453052a163e287f374fce59d14af7ca375e103e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f27c3353bbe8071273677e0e3d6b4188

SHA1
0c11a9a21a6012d774c1134435d27eeefc6867a8

SHA256
1db26e0cab6adb01086e1344f65355b6ecd0d266b9ebc7c6cc4b6d192fd917c8

SHA512
6ca6a81139e6106a7921d7fb25953c30d9ffcaa0477bcb5b68462af184bd2c8b90d8cbdf56c521b39cd89127cf6f2bc058a82bacefad2565ce443670b0ab1707

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b92ab83c679ca44557530602c83c3af

SHA1
698a0b6eabbb3b841602bef1f7fd6dc0c68a82b6

SHA256
2bc0be73c7b1ce20122ef05564e81ba42331e9045b246c8cc2c45dc2b842688c

SHA512
2e0997f166ff609848dda64f00581f28e654f6a5783d7378053757dd440973b3721a6b932d6df007dbfeebd685a2b8782950ed340f68732e0026d150d436c582

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68af5b71da1aaa33e0f7d057bed1f841

SHA1
4b3ec6edec9817de45982f628817da7409fa5bb3

SHA256
f052aa107150288644508623f066d91921c1a70c8b5cf062e096577932f6a111

SHA512
d1ad19679607cc60062910f1ad86bb890c42a2fee17d2e3cd386ca5602bfae0259d892b2dcb6d00eb22edceca5980e501ed8c7d7715a6fae9b6f7eabc249b324

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8AA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar96C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit