c6bb7377625c7cdf4ccc9cd85d98ef92d05f0a4c13870973ba23bf9277a58084

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76ab6ac774de29e6ebf4881f6b57b1dc_JaffaCakes118.html
Size

27KB
MD5

76ab6ac774de29e6ebf4881f6b57b1dc
SHA1

125f52c13755c95cbf53fac6b66ed82ff25d03b2
SHA256

c6bb7377625c7cdf4ccc9cd85d98ef92d05f0a4c13870973ba23bf9277a58084
SHA512

a6720f00ddb92e7e07d2337cdb6bc9563ba52225cfbd92bf73c355a6ebc3b74cf8ce733f16f0601571d743852385ade5c957e3e03cdbd9f88114c8b123d4da6e
SSDEEP

192:uwmKm/wkb5n9anQjxn5Q/bonQie/3NnVEnQOkEntJy8nnQTbn5/nQ9e2gYIm6AqQ:EQ/wiVgRqSd+5O

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{505D9D81-1B9B-11EF-87AA-FA8378BF1C4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422915803"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2076	iexplore.exe
2076	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2660	2076	iexplore.exe	28
PID 2076 wrote to memory of 2660	2076	iexplore.exe	28
PID 2076 wrote to memory of 2660	2076	iexplore.exe	28
PID 2076 wrote to memory of 2660	2076	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76ab6ac774de29e6ebf4881f6b57b1dc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
689203ac7cbc17ab2596e8c79bdc96b7

SHA1
a9cc7afdcce74d11898175a00d7d8c2a375eb1b8

SHA256
6b85ebfba1efa2e2cc3f89c7b2a69de1231ebb123091ce5500ace4789cf78a3f

SHA512
f842d63f68116e8a9b233fc682681d2b4130b6011deb0f04a07464f3e426aa11d359fdd4b953d52b38c13b7e55432a8fe2237c24a3d6fe74c2a615ed956b5071

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a5dd578b4cfa6faa7506afd726a0de29

SHA1
11eacae33cb8a6a30ad4c2b00080e2b48a8896b1

SHA256
e17631cbc5a586959de21f0ec4574b8a4d84947b5542553e397fe57ac3bdf86c

SHA512
d1c1a47c90945cbafd86d3b70d0371d5a443d436f9e54af3e82dba78b1503f5ca443552dec27b4eb42752b3352282b4147dd9d823218e91a38ebfd2526b2bc77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f728fccd78ea9a88d53bc9b6948e9f7a

SHA1
eeae2b23e362312a601e79be82f751d702f6a49a

SHA256
0de9693d1ce908e34c9b626bf96a8e101906500a43526e9ef9221fc171d7ed11

SHA512
78a1429875e5bf9aaf2b387d9d097a5139c0cb2cc19d382f1523093d3c54a91c452cdbac7077deae9c5982e93fdd7c2de978b7bae3ad025369e22cac1f287709

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
523a994b54884ec1ce4d35d363177cf6

SHA1
b6bccbc206827997e12c2b80377e370168a50681

SHA256
e4b9e61bd46b3a7613338ffebde37ff3a4e8de4e3e1a71349576f15c9c7e476c

SHA512
e3033898bf9d52482fabb8223646bd9119c121298537f147d0804ed9c40215c457eea025db93261c732d8e7094c5addf0da8d7107e39a5548b3a4e7a01d72035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ef70f0799655d294fea280532e60ab0

SHA1
09fc8e33bda77591716185ce991c87ca63ae87ed

SHA256
1de7186e1bc15e7a65a59b0107587ae048ef944557868f238235f6f554bc8b48

SHA512
3b24f2981214a4ed0981771802e6842d5346f59d01a93f2509925cfb1e4732ebec0ee438efd3dda3c6584cb99045c3a3ca182eb0073e0d7ca93f7bcde96d8876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38755f73ef485588b10bdfb2f2abb5ef

SHA1
af83a67e8f589a66a580fe73f625f99dc4ed0a09

SHA256
cef59d6b01e553b1b5852337a0812f798e8bd9e991183f843da092039d5a0c9c

SHA512
a45803d9772eb3c2e36f9390cfd0b46c809a33a98c767e4c7ad68f5b202f40bb6d6470059fb3791aea3ceaa088f6006a453ec6a539ad69ad17e41b3a74fab0e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70b799722e3ecd5109a7011d5167a584

SHA1
fa24125a5c0a6e32528b9b33006479fef0f02d4d

SHA256
7807cf31c5e49da1c28e86c525f595ae7900d25f0b4afdc942a4ab681633286a

SHA512
59a909b59161ea53f80121d05bfdc5f93a1ecf423eed438c533c8f773f56953962d7d84aca1b5b330be36fd3fdf0f925adf78f622c3ce0fedd12ce1e41f46599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be824673c7500b90f22d67a77e2e8f03

SHA1
0c97c9c2982ecc66664780e4b760d13b1b480901

SHA256
c6472018e960e585a4e849bd087dde828fa1a86bfdafc970c63778777efc33ad

SHA512
119a1fe06a52cd7c7e424cc827d9764996bf1b8cf1cad4ec948f257889319b4058107804c38bc152f5fd7e2601d90ad4aac329a2e2d78db7f052238104db7225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1944b43095fe62ae26f8bab494b2d37f

SHA1
c728bfac5639b37011e5aaf0adf72aa93fb16fe8

SHA256
3f52947f44a2f63f30dff42a3785719e7f2c7f6d56fc0b4c0d0ef314c1b49032

SHA512
ae13e1b1526d02ca358b119bf42ffba3e4e5a7155cffb7e9c563863e0dd95c9f35406a19796d4c6b95d2e62cc86090dbfcc385cda0bbc6b81627ed0a3f0d943c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D12.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E24.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit