a46c8d9772365ec9f6859e0c01bbfb172421fa3545ed6ac56308f42f2958d90a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76bc62f8e79e42b3a0cd1819c34f6ea5_JaffaCakes118.html
Size

22KB
MD5

76bc62f8e79e42b3a0cd1819c34f6ea5
SHA1

bf8fd048b6912d565e69df0e62192e59d4746097
SHA256

a46c8d9772365ec9f6859e0c01bbfb172421fa3545ed6ac56308f42f2958d90a
SHA512

90832e0d276ecbac54a3d9d7af49be63f18ed57275b8e0265e3b57a394d6c0db66d98de1b812b6db90c33789756b5d2b6bcecff85f5f439a1032a598f3879079
SSDEEP

192:uwHcb5nJdnQjxn5Q/linQiejNnenQOkEntzkmnQTbnpnQmSIxwGyYO5xHMBDqnYV:bQ/lAG3xaWue0cj

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{99E6A111-1B9E-11EF-B5E8-DE62917EBCA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422917214"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2196	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2196	iexplore.exe
2196	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2912	2196	iexplore.exe	28
PID 2196 wrote to memory of 2912	2196	iexplore.exe	28
PID 2196 wrote to memory of 2912	2196	iexplore.exe	28
PID 2196 wrote to memory of 2912	2196	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76bc62f8e79e42b3a0cd1819c34f6ea5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3bd903924d3e6d04a195527e630b50ed

SHA1
7d75fe057db3feb1b9f2cd1e1ab9f3253ee3ca42

SHA256
0516d2a29f3c3417785bb5d1b595c4c8288e61efb80ca57c997a3d5ed51661ae

SHA512
1f0cd198f4e624c59941c19fba953f5c3041dee5e70d76a7bd5e8f779956e28965b9b35e5dd933cd73434a55b91473797d4396b369c9bde98b7213addf09020b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb992986859993d2f3b493181efd77c7

SHA1
6bc85810aab699c3234a8bc5626a476dea26eaf9

SHA256
97d761812393ab1ddd266e4e034e9e629d7cd607977ecd1b812534e31dfaa2a0

SHA512
a379369dabc50d0d28fa03ccdf258f6c0bc9418a8072258a4c7845770bfec28f3ab6f837d00af889d63281d75640bb6546212d56d9d259bd3d29e64bebda48d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20b44d223444765d64158137651dcb35

SHA1
d4d63d7e5188e134087e879827a502f86f8e454a

SHA256
bbd28dd140bc1921ec6c75bd7f0f7e5a6088632eb8d8b3f4113626a975fab742

SHA512
a56d4c0c39338048dc88cfac51ae2bdeed8aa1357e6d84c7a6e62ae3c57275a6a7761b2a28c65af0feee01d565ead607bebeedfbc9d582c08935b7bf70bc8538

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1c518b4ef9881a46042d18a09222c47c

SHA1
f6ecb54cb56e4a4be2e2fb96640739ec7f6cb997

SHA256
2d35b3ba5134cea34e6c787c2e36378b7f8372de03411656bd974fe40ce1f33a

SHA512
3dce653e78a21a70021eb403637ec1aed03a69ee0f3a62f89c3f9cd6d94b69aeecb4caf1212bca0a166ddabb870813d6eb33fbd6889aae6f77ce45388b1f3027

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78a02abcddaec2c846e4ad0cb5e0cc4f

SHA1
a6fdb072a8e86a0dc0506395d814ff899302aaa2

SHA256
3ceca00e96099c784159daf1c135299f02d4c64770dd8ae6c77bda9248be98b6

SHA512
2cbc3a322680027ab52466e7f23b62909ba51bb1051c792141d1d7af8dd6e5f2375cf17ba94abc7f2d8a81fa63e0c6f4d1bd88324af6de16df34d1c42b964816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd14d50749a3b2da46915fe4c307f558

SHA1
1745db3db266b5e2b3235c0ce857942021a746a7

SHA256
dfadf1ca1edeb8a8eaa3fd46cdb9ce2690233fee1214a5d0417002404c08fb17

SHA512
ee469bebee90ba8616d205a44e17ae1ee61baf69dc5c416c3bf52fd7adf7cc28fa38036addbefe60dafec6dbb9bc94743006578f5f696f040bd18a9cb7bebd47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57de8cb1902e095d823163f5bedb7c64

SHA1
df05414fc2e130cf3917cc55f7ea2b733367cca3

SHA256
4155a43cd5a6dd4d7458a0f1103f50defa3d422f15595d996ba3535519386df3

SHA512
277d5c72d40597c5c1328bc31579a63c6d2a7a8ce8c47f2f745a06c690739cd14825a253b9ec7ea6ff83f3a49cf14bfca6d5031783269da30a9d5bf4775b7f72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5104bb3a7b624afd59089eba38bc9f83

SHA1
347b24f84d915af33ac48adc549d830b3e332b0d

SHA256
f5c0f993325272dce648b7fc2f83db3bad989062edcaa1ad278457de04197af3

SHA512
f44a176f1d168542ddbfddbc6f1a35e0a3da423183945768dc9bf8ff3a6f1dac85608e53cefb2028111717153fd79e9fbdc6e239601a8a7fa38141ad64b4f769

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4694a43af5e5ea913dfd596790f0254a

SHA1
8f68dc341931179993a78cba88eb35d7a23d5c96

SHA256
71394b02a42e50593226c7b54ed5906bafa7b4497d70f3d2b9646e11dad10145

SHA512
28af06e17f93b954e1fd0066f70de9df7dcde54d4cc4ebd1aa22de2c6de78112a5d829410010d18c21cd90c68bfb533da11f4c2d25e7f4ebd3b3b42c5b773fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7afc688fd236b99d6c76aa569ba5493f

SHA1
b6417363f18de7cf1b6cf8834f12028a9a1c1205

SHA256
05d9ded5490d3be440f67ab0f332b423fdbc455a4f2d66bd1d79ee5223515b8b

SHA512
bdef7edabe881e6b0deef63332751dbf4b916a3cfc938c61a55d62a289a235dd195a4b4502479f186aca47b500ca9504eec0fba0393ab1d6f0a54cdea02e0c95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab167F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1751.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit