3b399fdef05277b86123ef8c310d5c7dea25fb61c476b1fd8c480ec61f3c5e8e

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76505d6fc0a1e0006d0aca33000e87d6_JaffaCakes118.html
Size

18KB
MD5

76505d6fc0a1e0006d0aca33000e87d6
SHA1

6be714e5adaf377145a914455684b94248f37fa6
SHA256

3b399fdef05277b86123ef8c310d5c7dea25fb61c476b1fd8c480ec61f3c5e8e
SHA512

d02c55560c24d74457f27271ee519fb357a2c8e24311fe921fba6e45805da53110dfcd449f70c674acebf7dec19f97874a64f217677f7055b96a923d1ef37ab8
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIk42zUnjBhaM82qDB8:SIMd0I5nvHPsvafxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F77CEB61-1B88-11EF-8FD2-F6A6C85E5F4F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422907923"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3028	2932	iexplore.exe	28
PID 2932 wrote to memory of 3028	2932	iexplore.exe	28
PID 2932 wrote to memory of 3028	2932	iexplore.exe	28
PID 2932 wrote to memory of 3028	2932	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76505d6fc0a1e0006d0aca33000e87d6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a242a3d6cb9fd7fb791cb47993f5992e

SHA1
b6a40590f5aeea4f0584885ab941f8c8cd4fe873

SHA256
21e71ab1ef5e812e50ac81ebb9b5535107061aedf3fb0bf43951da98868f11af

SHA512
56a0b674247aea7371d6772b26363e5d3cc9ffaae3ffc25d9c974af23518f576a20b10f9a790cbc85ded02c2997bbb8a85975a4db7eaa7ad6c7a95433a9453cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
efa06a3022bf9881a2b5ab229426383e

SHA1
7bc297d60a0e6f63a8743ef200753fde90d69b57

SHA256
a8ce51ad455ad4374fa45ef24ced1217ea334484efe3eb2bc68ef8b0de1ac69c

SHA512
264fd93325e9f925357c09cf81cfb3cfa5d8e29f9e0f831d2e156b180a974d6e1680fd492ffb2e4c4482b8306d0a8a41aab9e326d8b0b8ebec54aa3eaa9b1aca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6cb06c35833d1d437b6e6663a313d226

SHA1
b4f24a84d704d2a58f43df6cfb2773839b8ff323

SHA256
ad8c219440eff7b93793b94f881a8d7f6c88e865bc67225914b6e7a51d8f8985

SHA512
d099be948b1f40828bae4ee439eefb66d5e3c5666a6bfdbf70a1849135ba9285ff1bbcac0ce9f150af409ab613e071b3807e4a5135e5af1a5056564b149d34cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfa0f519dd0ea37e523306686b687e51

SHA1
e14aa220284d2f4687e59a26b5820ec46a506df8

SHA256
9ba4e027152ef1130951ec924c0096fc95409b59f38be5e81866c910b0aa0dbc

SHA512
98d19732a6710b04a429cb8083f5bc33d3981d147a22158af5db6a1190b5b069b79d03a47b1f9d88257cfa6901bbfbb7226373f8a3b595f753b76aa9a685d9c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ba40b13471549d0cf3ad9409770d63ff

SHA1
783aae696250e9c9bcc6f6a3e0a66ada6747aab8

SHA256
d53c71445ae14fd82e5869d1264292086b1e4d61fe768652839048a9f039cf28

SHA512
1593fa7d2ed29d410540a024f7845940ffc4107c5dc3fceac8994c9b3888ea210ec8344afbd13ce98568c79ef1cd3728b1357743fbfc9f1dc8b64a2a5cf88eac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1acc34bd01894fbd2ee068b85bc907a4

SHA1
9cfad6ecf416445464e537fcd7e59a720ed83e24

SHA256
7698b313c102cd7e71f02dbd75f9344c6612f0c4ea54384e5c7cb52a73939ce8

SHA512
459c14ad3e3bab9ee2cb00b9e71d4540255650a168c7a19450e24ed042a3b3d2b02fc0342f2025a7df3a98927f4605252992c6e87a28694a1c3e63bdc13f8da6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
87204e63a8d7a4d2794d47f9363780fc

SHA1
b97c408e3b6e756df5085705f8cabfdbb58f64a1

SHA256
d9a93ccc8d551de32112c167b9713d8fe3262aa90a8813f1ff58c56a453cb953

SHA512
09d4a5c103bd3ff81b6200a80267c8c2aa4baac78d26086fc3938d86cabec09306a86f52770202b424ce105257013ab893d88cc7ba04c82ca311a74693b20ff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7db46f14f8055ca312247f1735def5e4

SHA1
9cd2436f32f9caf6a9a5ea4320e15efed57ed696

SHA256
aeb913cd8bbbf31047bc7018627c33541caf0f3e46e175ce2b6f09fb79f0a4f0

SHA512
f3a5fb863540a1f8ca12b5c5a2350e27da47020c8b7ba2136fe37781cebcd84f75d2f34f9df514b6e1375b9c90318fda6758a86ece80e2dfd5d99eff3b641603

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6531d57200f576394e49e1846d47f948

SHA1
1911aa93cf1373a5b1c0fe09cc7c9e2a8441c512

SHA256
728ab9d90802c82b6b296f063131e170d5255cd5360c866a6bdfcea341ca2e0b

SHA512
d3048c2ce3fb287922d0a38ac0eee0b86fcdfa1547be79aa7c11fbf3c6615efa6c7e87062d613b161fd3e7d84124922bae82f8bdb575872115f7ae8c4a9aabc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C67.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D88.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit