b5dc2350eb8d052e5c50516fbc78560a516a8b27b02ae37caa41cd489afa0134

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76b44de5c02ff04ccc0d0a93be29a330_JaffaCakes118.html
Size

68KB
MD5

76b44de5c02ff04ccc0d0a93be29a330
SHA1

a93a862e623e5e86efd5e6f4352072e2ae0ccc74
SHA256

b5dc2350eb8d052e5c50516fbc78560a516a8b27b02ae37caa41cd489afa0134
SHA512

8de196037f762178ef133ec796883c2a1a20cd6ee19ced17d3cf11837f3acfbd9222cbf8bba22d355aaac8e767a1ff066e9ae6a6ef97196d0aa730f812581c4f
SSDEEP

768:4zfoMRQa5MMb7FWTj+HR5kBNC2EvGpf6jGFPQvotxotry9X:4zfoMRQa5MMb7oTj+HRmBWIeGO7Zyh

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422916468"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DCBC3A11-1B9C-11EF-91CF-DEECE6B0C1A4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1776	iexplore.exe
1776	iexplore.exe
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE
2000	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2000	1776	iexplore.exe	28
PID 1776 wrote to memory of 2000	1776	iexplore.exe	28
PID 1776 wrote to memory of 2000	1776	iexplore.exe	28
PID 1776 wrote to memory of 2000	1776	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76b44de5c02ff04ccc0d0a93be29a330_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dc57c8d8b185dba80f624ee4db2b5790

SHA1
c93ba5c5a1f46eaea92de163480a4c8d81298c2b

SHA256
1f29ac124621beee0fcced2c1c061fcfe0424fdf7447b4e054bbb8cd5adf2a2e

SHA512
cf28abd40b8b4f4105dffc7ca6f2e5c7d157227c2bd24db54a2259ac9017848054ca2f91f88c89513faf2dd6109022231e3cd7f969c7e0bede7297ddfcdfcb0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef84f63f5b2094133949e86c450610b7

SHA1
cbb7f2429fe0c195d115729f01d7bc5326bd5485

SHA256
f7d491ecffb3fb18de9c2d0c81a1175d45e7faac94da5a90283574b4d34b2223

SHA512
a36e8829135fec2149c061d3a2ee083a62dfb1e984c0928cd6ffcb4a70001d2335a457876c1c29f1cc7917f1dc14470c806e081c0413b4ba773d461896c13b09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a4be2ba2e71dfce973f560224e43d07

SHA1
7b199755c789057d5dad35d801d4d555db385a82

SHA256
5cd5e4e83adac99a42e02d08c1bd184675ba2648ca22cd5722abcb1553f073a4

SHA512
9c0f47606ffad76f7df338afd50c66dd35437c07ae2e3a0f879bfc1782c1a4b01712bbab0f0760e697663bfb7f93f3e699d61d681342c0717a099744dd7ec806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
18071d7625724ceca9255a97a5a0c751

SHA1
03ca49b3a56cef9602559e52d3019acf21860105

SHA256
f385630746b8f31ef50de669ea766652ecc99a4fbf410127eb4f5a4b111eb842

SHA512
061b1394412539a9847104befc9b140b89640f5a2966401284c28f25baa4ebfb2cc04e1a34c4bd6d500cb68967cbda6e1369f34c4649417c1c2d7f4afa024d50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
64ad5e31fc48e944c8ef8c2d04bb33ac

SHA1
927d6a3f7fc8af40d5daa7814be3458b4c2f35ce

SHA256
421d119578ab944c728ecb72fb47231ef34652f0fddca01480f9d5a6540eee4b

SHA512
12db24c446dfb5fd69db791eca6b887fda6c46a11ce627a78b71cf087ede579baadb7a1505545b6f6a11d012a3e787a3ab19b76d43f47899d2aaa4d93c256d80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a9efbab02efb96a66d9eb498b47ddd8b

SHA1
a73b325e81ae47cd6d95701da542c820452138b4

SHA256
b1e19c66ffc26a03677e60e0b4e3b0385ee0d65c971c09087518c72730b9fdbb

SHA512
aa11eeb718891cc293cbe79ae801a07ea20ada5c414c26a5a2a870e8ed035dca0e4588665751c1f781e0b4c0bb383fe110ab696293b3ea0d2f56eee954d34a49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71ad90c2bb4b445ac5ba9c02b8c0c33f

SHA1
04165bddcbb9707015d9040ac93dc141d539763b

SHA256
cdfc02b4c06c7df1db2ffa58e54f374deac4a060fcf671104e68dde136410e70

SHA512
36251d2473e8a68d59a4a76a1c78820be413743596b6407baecce373adfb9a61e2eb922667d54cec7a5cc0707827646a554956a8120dcb9a7fbc2e420166f473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ae34f832f27d4d174826e8fa43ab8f25

SHA1
e7f6b64849e96c63f36448469e8cd0388f9b8ea1

SHA256
9f68c79ecdea0d3cfc8546996d5e0efca9563a32a07b133ac5981b85a6f2c661

SHA512
92f9ce736534ee761f38adec96193e3d285101ca8170f7870096783b605c9bf39f45b31d4f4058b4473bb3b92799765d298f722493bc413def951244e0c3aba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d1e2dddff6fa788a864b8501fc85d1b4

SHA1
4616a5d1548c1f9c9b6f81c188a14cd454a1bd55

SHA256
dc24aab297880781dd5a08fff1f7bc146611c68864e0660db48da612f55f279b

SHA512
a5879cb1dd62a6ce967a55f983cca1d46230cecb18795782d7a6f4d57efba9c89f935ea43299e970cf3ed90dc42105e0fdca611f2369336ac20b59379f105992

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab15C4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1625.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit