d4a2afd15157117485883cd9e36ffd2269ad281f556acaba09933e874b5a7dd2

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76c853259f1460f7a8a0b5ee1af10cc7_JaffaCakes118.html
Size

137KB
MD5

76c853259f1460f7a8a0b5ee1af10cc7
SHA1

4e04a512c0d612eac65f6c550f900c9a091db6d9
SHA256

d4a2afd15157117485883cd9e36ffd2269ad281f556acaba09933e874b5a7dd2
SHA512

8b976a0c2dc73a836a60dfbf1b82be0e69a1bc743c1e0836335205cf96b784d067fd1812777cc133204b182359e077156c2280fac659633a0cda0b1ea6eb59e2
SSDEEP

1536:ztZydlEbbA99YZHqRHHEExx66++IIddtt77bbSSSSccllbbFFDD998811qquuHHs:z6dlEbbA99YhV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DDB7D71-1BA1-11EF-B393-E64BF8A7A69F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422918348"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE
2028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2028	2928	iexplore.exe	28
PID 2928 wrote to memory of 2028	2928	iexplore.exe	28
PID 2928 wrote to memory of 2028	2928	iexplore.exe	28
PID 2928 wrote to memory of 2028	2928	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76c853259f1460f7a8a0b5ee1af10cc7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9706fe0a43b6e8276c6608ad638f725a

SHA1
1483bb0dafa7684dce663611ecb32d4ca5d62e62

SHA256
a8adbaa4060732e9b34c42970f4c1f16d557a94ad49b4c54f177db901c7ee484

SHA512
366da86c975fd63a4605c9412b2ce9b1ba632db4a9bbca18db50bcb673bcbbfb94124f8cdd6119bac9c4c1abe186ef509d4bb48073cba000e968f2080fa86268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a03b26711c7d85f2e3e79b1281841912

SHA1
2fa07784c92a1df22b09709083edc4d1c0d651e0

SHA256
1bd6b2ce97daba54f5971b8bfb2bf33119daff81a49bc8375256cce5832f8a0b

SHA512
b4059a07478b52e43f8e1309e0e98b897be1a963d1485e30ce99322dfe5292432b1f53430ea35c991edfee7adfb1240059e80f30e45baa55225e306d291498c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c20ed68385e3a2fa7ff9b4b366e0ecf1

SHA1
d8b8a11805c6cc8d52b7ef81d5bb2c597a4eb95a

SHA256
deb25c45f65be3bef0de8a84918449dc19abbbd38ef5836647893548df619c78

SHA512
0ab85ce6ac2483dad2641cd650d62ccdbde3adc1da11dac2c9a0f5926317b803953052c7766619866724dfc71a53057a1df87dbcb0f06c05a660919b8590fede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9c095352a3f5721cc31ce6cd124f3bb

SHA1
73cf1f998d66072846a9b1172eed9839773f850a

SHA256
25d43890ba3be8cf99b0e890cc0cc3808123e9640ba49153ab336832b4df0f04

SHA512
ee5ecab385bb33c12c2792a7edecf739546aa59cadc163c5294b4ddf9ed26457e9eb3ea0efb86c0f28a215a8df3576f034ca1a3639e78f8264283270e572a26e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6828c528e670cff26418d09fdf4ce189

SHA1
16b6bde91e1a55a860efc20c92098c223eac5f06

SHA256
bb3ceef01801e15b55d5d525116d430b7fb445085c3c5df635b8f41f0a5f51b3

SHA512
a9368676c903a2eb86ab5d4840e7b2c8ec1579e081cd2eeb6a95b9e80adafdaca75bdadd5e4b0bb651b716fa726a78a595ccaaa19631c48336ddde1f3e8e0b0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
810207eeeed86178d355a011976d623a

SHA1
9f6b82276d50e02082d0bd51d8f27ea0ad94fec3

SHA256
b6b65273fc15d3fa4711d0b37454b048007f8390e0c02805239ee3e5f11b575f

SHA512
ab1bca7c2f73d994a472ce46670c06b7305eff496551de5c6e5fcdb7736511a5a22142db52b36b619ffe5f88e1db986ac0b63d800398c4062a24df577a22c418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ee970123d02696c5191fd704b604bcf

SHA1
a8e2c7d5d370ca4670ae185890cef51733be619f

SHA256
0c323abf329176abbc8da7cf242a08c3a93d38ea11f0a5c4d56bb1bcd546d1cd

SHA512
84e64580921a6e65d9708600db8ce09a320f74006ffda98e245452693783094516577c1e53fadc4304f4469de9cd726aa60f69a2e36a327ff88ed445c80ce605

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e08232fc448f4af4afbe5a279f368dd

SHA1
f7a224c1a6f08f9b00aa7830393f891694738b2e

SHA256
e2d9c0926c677bda91ae28ddb35c3644cee5e783514d74ada0a5bb190fbb6fc5

SHA512
c8b93df4eb14f277644fcd8b4a63b516fe4999a267fd915377e59d4c411e4667bc10bdd8ac6bc6361a9dcde495938c0571164d5a4523f0ba2d6f272aa44fc53f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0629e7839e274d513409284b4a0ce54b

SHA1
33a6034ee5c3cd37f9a19ad0ded886f0e2ca5ee0

SHA256
a90293e29b0c3dace77132906db44671780f422ae00b32d0db100736d73a418d

SHA512
b1877cd7b22c292d80ee547e9eade072815bd3d74c2b043df24aeae55a9412f1a2f92c0aba0bd0d30bfc32765b54a6c03e82539d508c5d34d3d057df8ff3733c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2127.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2199.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit