470cb3a5eb8406334e8b259bfd85fd3ec1ef01a1fec87676b9da40a5b792fd07

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

766bd62972e24641d6e13632433fa269_JaffaCakes118.html
Size

25KB
MD5

766bd62972e24641d6e13632433fa269
SHA1

a9a5183a0a5f0ef06b84dd31a6e49e2fa8020786
SHA256

470cb3a5eb8406334e8b259bfd85fd3ec1ef01a1fec87676b9da40a5b792fd07
SHA512

a13e8298131be51a2017d5d23640647b4560a22e9c2a5f668c9ce9d153743d3da12715d35b12f0fa3341d8153e47330da58cf85a3a04c01ae34c98ff402baa13
SSDEEP

192:N2Go2rHb5nXnQjLntQ/XnQiefn2+hnQOkrntBSnQTbnOnQxMCrA1pdEDwuXM5nzN:0GoQeQ/P+cd5Wd

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{13D06851-1B8E-11EF-822E-56D57A935C49} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422910121"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1676	iexplore.exe
1676	iexplore.exe
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2324	1676	iexplore.exe	28
PID 1676 wrote to memory of 2324	1676	iexplore.exe	28
PID 1676 wrote to memory of 2324	1676	iexplore.exe	28
PID 1676 wrote to memory of 2324	1676	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\766bd62972e24641d6e13632433fa269_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
091497b91c9d95b3dafbd67c5e4fc8db

SHA1
944964394f1b8e08a69419adac999048b8ec4fd3

SHA256
368d0c6ff6f4f91296167ed55cc3fcbd9bcb4fe47d9ebad638ac8c526b4fdb66

SHA512
103f9109c580ff297bf1c4df0b33062f3038879bf111813bf9bc975992e2fddfe7c2dbf78b153060d4f1bf70d8bad17f4bbf5509c441def0f7ee2b267186a411

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a659667016b87167f900745642c78525

SHA1
bfc2c3ebbd1a5b6a0b067e26f2a02d228ccad85e

SHA256
af23a336116c23cc5a8c04a6c74b1ae1a9d33c8a46b71288c94442d442f9b0c8

SHA512
26601978ed255e534c26b2caf7b45e9331c09428e72f8cf137086d1fbbe6568732e5be194ac972db5fca2cc6476666095b1034ffc2ca6cfcbdba49461a3cc95a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
faa590c57199d19c61dda62578c1fe79

SHA1
07757aa47610f969d8295fe897f2db05bf4f397a

SHA256
e75691e6c7dc63957042c65352ea63efcb44649e5358d2b5deb93aa2404a66f7

SHA512
e61a017ffac9d9ee4db4155bb4174ae7ab36275c67574553f3bb9de2b55ad110ac3be3b4968003d9bd64e2237f712d64a1692d675158de22e60527547c636963

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8b381c5abfb0894da3c800e6d141490

SHA1
5ac1fcc780c6b11f21156dc034ea6761493fb398

SHA256
986b6e44006dbd5795add1c9a9c0c43cf021066bb8110e915e95eec0e4b809e6

SHA512
d6b643e05fbb62bee34e622ac589903af58c0096442e0b083e62f52615cd520f7b25af74a97ebaa9ef7c8fdce900c67ec54dbb53e686b24734b3967f3b1b0157

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bcc9cb984ef6f3c4e8ed1f48fd33b9e4

SHA1
1257fd9cce1c0547d03a4e22a3b25be27458a896

SHA256
41a558e3ff0b4c918bec80483962fcb0033e341c767f550ecfd2bb9fccba7170

SHA512
6a5fab276f93ba88db0528eeb36c39e03448cfe5ac2658fa8d3c286a26ed2a96bb346e8f2e6b4a5a975aa5fdd9015055636569be4ec7226433f1930b682a583b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
431709bda5a6b463ad6e2e41f7f49eb5

SHA1
7b538eeea217f1afebeee3096e2bdf31f1904876

SHA256
d4215121cc8b9f82b923d01f9e403ae508886ee43b2241df9d04c2999477abb4

SHA512
f4fa121f544da430694738c89705218a1137c18de135396b598ffd303562a2df2fba6e722365b842d2e3931069e293924ba64499b9ed3df24f04c8682cbc8ce5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cf54ca470a2d129398d843dd58480b8a

SHA1
cbaf57feaef96efc9c2adf87c268a3cbb13c5a64

SHA256
7a2f587f78ef30ce6d66e2ee2249502d0eb7cdbde51f4c37e233a5403b924dfb

SHA512
c883852f6470f8adcdc24b6d3495eaf6b8ee69341a90402585f212d1273b4c1bdb09830dda98308da7dcaba181c11450e722ce669d180ecd5d8e78b7799e72ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bd0839294f90303c691a60d157d8622

SHA1
443e2873b2e8b8f2be02722d37b220ffb58ffec4

SHA256
3f1ee0fd22571649064756793779d4c0a65cbd7e25e0f88514fc6f2b5835c01a

SHA512
028f098d80a53e303d9e83979e1fa8c67845b0f8d474544e565ef576b645af83acf6092f6d8a29ed2fd1e5d3570db6eaa92bf6b74e985b06c15c0272512e17d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e457071dd55524304f6e839288fabe9

SHA1
717355a8147b96b3f6d7181f609229e8f8e99e0b

SHA256
42a6068e71b40360d77f4b256cc247c2dfdbe889c68cca6dc9ecc5b030d22bde

SHA512
318b492d408d77217d291bdbb36d332be33b25d4989bf941d29588a3fbde3b611b50a05dccb847e0ec4c421629f656c91bf305484ab7d7f456a8cf168b5e4375

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27FC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab28C9.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar28ED.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit