68cddc8ccf6805fb57af64d411d1d1d7cb62938ac928b3db0c9591d98d4b9281

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75e243c765f0861fc3247d34ca8aabaa_JaffaCakes118.html
Size

27KB
MD5

75e243c765f0861fc3247d34ca8aabaa
SHA1

4379c8ee784d290569b9f6d2746b46a739fcfbb8
SHA256

68cddc8ccf6805fb57af64d411d1d1d7cb62938ac928b3db0c9591d98d4b9281
SHA512

39b2e0d7d9155234b160c4976d1fa13bc59a91f06cf94aa9df8ac0426dc1039de1501612a8e9bd6553e602b59b6eca57416d1163c0435d4fa65e6412c79fc36e
SSDEEP

192:uwjIb5nO+nQjxn5Q/BnQieMNnGnQOkEnt7nnQTbnxnQ9eqkm6udgyQl7MBsqnYnp:PQ/yr8IgFS2Rx

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422898122"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25A1D801-1B72-11EF-B2C4-6A55B5C6A64E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 3052	1952	iexplore.exe	28
PID 1952 wrote to memory of 3052	1952	iexplore.exe	28
PID 1952 wrote to memory of 3052	1952	iexplore.exe	28
PID 1952 wrote to memory of 3052	1952	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75e243c765f0861fc3247d34ca8aabaa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
843eb615e2284279f50af7d2aa6198f9

SHA1
4acd3e232b1778bd6dc9886745153727ce39d350

SHA256
185e62d1e46065bc7d84aa45a7b26e75d8c3e02256bae74a28640d5d8a279b4f

SHA512
55ad03c7dfa118a7cb657fc0156fb78225ef3a47fb09eb9a96b93dd88b105f445a89d10e821c2ba46e701fb4ea2ae311082900a61882f94e5a248fd92626cd02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6abcd6eaecfde0bcf06914e654530ee5

SHA1
7dd13509760d44d2d1272176f8583f0708294a10

SHA256
d835127b77404707654e63176d3614e2a01001af7b501346d3982b0cf86f4a45

SHA512
3292231e4d2e871b17433c4e1f48ed31ac49b81055784a348f8e19cffb33ba144c9c400adfcacad1aac276d26c011bb4303627db5ef7d20b34975521d8310d6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afb825841e0ad34454a9bd4c598fdd7c

SHA1
78ce9932eb8d57f03a1161341fdbd5606e67632c

SHA256
481f3e29b32e6eeda683c322194bf53256254f167cb9baf7fc9b102dc63d141e

SHA512
7bb43a0f4a8435a029cc5460aece0c8ca4833b30705d4d4bb043c0f3f37f45f8524fe00da57356a7ef112fafafc4e723aedf0062fe9e13c637da28c72b0133bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e3bbbef1661663b5eadf25aaee1fd15

SHA1
d4fcc655d1ccab489ed96f64d61496a978d6b4e6

SHA256
88786c9c224ceb75416e5c4b05680a315e565061f7e331c68a7b41595adcf6d7

SHA512
395c8f3294ee3ee73401e21901733522ea1d463f8c325c67b05e3590d17af44ba20c5cb0c9cc40d17c7456816f6a0ac9e11b24dadd10378a0aafe929744893f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84632e1a255f9362c15bd0f0e8d85c35

SHA1
97b3ab8a1f0bc0e3e37807c54729dc3efd6e09dd

SHA256
3efa0de738365c87fef5ef4df5a6e65ffbcd35f8d8be7950e728efb33f64e3dc

SHA512
1809def9aa9121c9e8da78efa290a2e9f1ba62d52d29f267beeec92a6358f99007d6c9416ba0e6403c26aaa79c3fa64c5954306a501173d1192d81029fefe805

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9270da59864250b1f8d0adf7725cce8

SHA1
c5c488f1a64ae43918bb1f19a7a40df4e01951e9

SHA256
aadb47b1ab5a423c757fa154942ef1014e1d20ad9b673f861af936eefb7196d6

SHA512
69e35be11a61f106eca3f50bbfdbcd7f484ad783e68ed8e743c9b06eb236be9c1676e322a5649b35b59c0e23c074c4f929ac27740889ba310d8cf12a395c18ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09d746467defac62a4f49cae4d0a8c59

SHA1
36504692b118d9932bdcb6a5899b2416315b9dd6

SHA256
2565a4ef007f533c82571d5f113755e7fe9853dd96aa5de0899610545c07912e

SHA512
0d7233e540b7b452779a7a8eedcf26975ba88ee9a4c8b032acca6cf3dd78463117178b5e9501a2fe2b6a0b423f58a59160176955fcd74221605ebc6f3b0c00c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
48a2108aecee7ca8b54c0122cea25a3a

SHA1
90c55a80f6e91c78272160a2eb3970e35f9439ea

SHA256
eea51fc3e1dfea612a5ca957885fbe1987d2009f65480eedf3c0507817a2d6e7

SHA512
acc1bfd514e86d38c479cb1ed5e5222fc6aad44b378982a9c6ac574c15c5ffa6ebb0f854d2d0202e8a80d4f80ac42a36c4d26fc59c6ab23766f5fa1793b8463a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8205ec0616b3abccec540d637f2b36f

SHA1
71c6d015a852c486efeac87c558448b79f030c42

SHA256
cad6604511376a355362142ea0efcd467ad77ebfee1fd2477c391fdb3b82eed5

SHA512
353cc3c0de58bdacab843d6a9ee34aaa71632f8387e52a53284bab2b46feb924e9670c1e7ac943425fdd5d25955eea0d99d0847940bf1af13755eef96aa8ee3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab28B6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2984.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29A9.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit