0ef6e609bf5f4bb2ffcf525ad0a94c79fe4e7854e6e7363ca00c285531425eb5

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77416949a19932af99a07aaf837a967d_JaffaCakes118.html
Size

39KB
MD5

77416949a19932af99a07aaf837a967d
SHA1

4097c4a451c2f45a93251f488083b662f7ee0196
SHA256

0ef6e609bf5f4bb2ffcf525ad0a94c79fe4e7854e6e7363ca00c285531425eb5
SHA512

08ccc3c0f589d50adef12b3bb9fdd42f3beca203ec90048d3426d57b9df0566331f1d93a6418c169d2c91b5818cbbc721d570c87a82f74475084de4be8131d75
SSDEEP

192:uwnub5nZuyonQjxn5Q/1nQiewNn7nQOkEntHvnQTbnZnQmSyxb53s0daBLSddJjd:6Q/G5xOgaFOjWKOYOfhJU

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8CE20131-1BBC-11EF-8962-7678A7DAE141} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422930077"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2556	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2556	iexplore.exe
2556	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2616	2556	iexplore.exe	28
PID 2556 wrote to memory of 2616	2556	iexplore.exe	28
PID 2556 wrote to memory of 2616	2556	iexplore.exe	28
PID 2556 wrote to memory of 2616	2556	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77416949a19932af99a07aaf837a967d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5ca7ce2824aa2b5335d05c59a50bb739

SHA1
c8260cc0bd7665a3aab9d2774cd116b922244160

SHA256
f0683cebb46e632a313adf68075ca56c6b446a3929877f2e93baf3f24c707e1e

SHA512
0d81a75c0d81e1625f905bf5a7b328d446a15da81412e9c0f5d73bf14c14875b4522cc609007c18f311e6a65d99e7d283e6db4346d7562654958d24be1beff17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0b1e24bf676ed2147818133bf4115fce

SHA1
ed11edce9c6b0ce629fed112b06bbb120a307c87

SHA256
71517c26c83ebdbe81bd3c91f33d9a6edf06e2fc1dbb24333f07af7d56378218

SHA512
83fe17f44d8b756237b0aa422b2e1da8b8e27490b2ba7facba3f66f752b86bf6f8822720cde160e65344fcba8b97858732345f5fdf0a93e4fa004765aa862b51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c9143732f03b0397dd4b46682d880799

SHA1
9f537d010b3c88b5f92a9ae61dc59d6052d9bf99

SHA256
583275a9b91bed4356ad6693b43389101014f04d478ea78a05e0824612f253c6

SHA512
514c81722cb260cfa00bec1232892bf0da90484b2d457f3e699359ec7f4a9fa23084edbf7abaf6e8e7416f9360a1c9088649b9955ba95704adae1f00507549b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d97bc5eccdf1a54c9ea998ceb52ed694

SHA1
d95199ce61ed45d96059544a11987a5fbb962348

SHA256
4572ddf1af0d779ce33f86885a52330d0f8a2f868b1b60516eee33de7359b115

SHA512
7eaea057cd356332c5733a6409bfa77d3e81655b7ddee4aff86776cf5dd9da067e7cad73cc75bf05a11959df210602bd0d6d5ed966da003eeda0a739ec54decd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4e2370af2c59f9627082d8d4372518a

SHA1
6f42e891b1eeee88c5d102077a36b8e9f89300f0

SHA256
7cd8ea0ac0f54e717f5faedf64cc359b589b1a674dd1f7bde804320db008fe25

SHA512
03b30eed9d39a4ce99b1a4bbf848be14fa8b311fe8c5fbd84ca131005c8386cfb9ad5b1374b866fd3720c853de998d3a7d158cf6d2d425aa059c5d0d96a69edc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdda6d59309ad9dad878b2d19ac6b308

SHA1
b51f7a1a37f28c06e4dadb644c4828a39ec7cd72

SHA256
5f54a7a69fcc84da35c8e5ec2b26dfb911388be21846e821577de0328d4e1ed6

SHA512
1246b4718b547fc4feaaeac9948d8c7f0486a9dc3a54dcb52fd34ac515c3bc9448f85bf418e55c90b8314d9954f4e70d4b5d57298eeec4f0faeaa4233b7c500d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a2c5dfc4b58fd3904d6af37cfe2266b

SHA1
6bf7d89336fd925eb6bee1efb92f9abcd8b5e13e

SHA256
e9b4e1d384d0a1f3f118ff09b0188ca5f839393e78babdb0554c300a544a6a5a

SHA512
b373eb9fd5dd36b5f58f1357aad3a0b93ef09604de7bc6e3aa94764d7f5c8ce3b88a81a074ef97e86867b1ec4323caeaf975ccd8899a3787ed33ff87963f49b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53192e4be558eae953ab4cc70910d83e

SHA1
dfb7b76038e150f2ff0cbb09b49277b1adab67f1

SHA256
79d9e6d5ff893d8124b3888aa8be1ba15ce45c605988fef25db790fb11ca7430

SHA512
9c0ac7d0da1be7ff1e39ecb9bf0086f4127602d9909083d4ec7ec4c4f044b765a082d267c28a4b532ab135467aaf3dbb3d2dc4e88c157629aea4e09981554ab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
789051714fadfd60015a7cae234173e9

SHA1
e940bc6c8913c85a670fc1c68ced4d72bf5c28e4

SHA256
9133b45d9b32845c940d7a8be81f61ad7bfaf3e93e40a017040cbe5335c57dc1

SHA512
502aacc5c1325bbf422a25b0277da05da00593f87caced1276965466d45759c677e06b2ba2adf647ec1e65fbf57222de97401198db8e5e25ece88a19abfa564d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2676.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar26D7.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit