7af4a3e700955167eeaeede516a7c1e7aaec263b45a622bcbfe21f2b4cd82633

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77fea6b271eaad6eea1858a2e9549c64_JaffaCakes118.html
Size

23KB
MD5

77fea6b271eaad6eea1858a2e9549c64
SHA1

87ea891652dfa3a1bd86559b1677751f11248419
SHA256

7af4a3e700955167eeaeede516a7c1e7aaec263b45a622bcbfe21f2b4cd82633
SHA512

e651a6293f1d1b177df6dd6e4fde9f7d9be54bf68b3b726c7a549c210714a734b663736c311d1b924b359c0c6aecc30fe9c0ad389c29493e79e23ec3c42dfc26
SSDEEP

192:uWv0b5nDenQjxn5Q/dknQiehNn1nQOkEntH+PsnQTbn5nQPCnQtdwMBBqnYnQ7tG:qQ/dh/DHT

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422948173"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AEF301A1-1BE6-11EF-8C92-6A2211F10352} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2592	1368	iexplore.exe	28
PID 1368 wrote to memory of 2592	1368	iexplore.exe	28
PID 1368 wrote to memory of 2592	1368	iexplore.exe	28
PID 1368 wrote to memory of 2592	1368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77fea6b271eaad6eea1858a2e9549c64_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b3f2c5b636e92af41191634fe647c021

SHA1
2c217ef26fa86f88f81f48a740fd484083472514

SHA256
a2f3b22cc34111e2c02f9fa2f792f0d2e436d15bd07dea36e6b2b100046b1dfe

SHA512
a1016e553f4e486979ea04c59993a934a86772aa582e9d558ec1a5dbcc7c9f7da2265efb44cfc44678893a209a510e76abd213128416ec0570effdfdf3324f89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed296b451543c7926080d05216477409

SHA1
4b19dbda02dbe5fe1f56f7f9307d31d4e54a522a

SHA256
3e4e5d25bfcaf0ebcd871450da377f50664bd9f697c4d67ac6a5ee8d05853b78

SHA512
3bbef77696ca5d8c9f122e4a81153e5f65aeb707d73f5635defadf435a08f73954b9e8d94569b4fba092d92cbd615d9091ba2c61b8632a766b986e79ce16e73d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f75111777c7f5dc11ff6edd6fb25b15

SHA1
babf15e1a53c39f00ff7ae652b7368f8fdfd9e83

SHA256
4e39cea98a5ecc63c601789ca3f512280c572e37eaf4f392437e03f180fdc2f6

SHA512
f6cb86991af1f7412806b6f731d2182f52a24b04c59e98b0f167afeb39cc6cf1a02bd7a566a23445e05a2e8873e7a19ec1953568b1bd956916f3283a288d2cf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38a67ae5e499f32c55bb31f3ec72b438

SHA1
4cf8b8f2d293dd79fb915252de02cce680f75440

SHA256
553a888a00ee93ae47ea2f8df17d719520f89b53ef8b1d5ca3f492d680ba7633

SHA512
04ad6d12cb6eddb27c8bfb149b6e8d54bb4ed4906d4efa2980c803f6ef5a83b4b129f5a57b26a0e92e9d9c8d523d777bb3d571e71296d19473e96621131e9d66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97ede3d2c9f737945c2b378b5949db20

SHA1
9bf18eb1ce0ea2ccd23824442361d87527c8a42e

SHA256
bcee785cc26e5039a997620267af78bf30fb6ab9245f5f7a244fbcf92b1fa982

SHA512
8564b23b0dd4ce6808bbf90c7cf5985d707ba081d779d5a7cff6d1e6435219032fccb8e559934a5bff372b1d04c8889d47bcfbf5899c0a1a811721d13677fe88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5f23c82e4b5e51437210cd69ab37eda

SHA1
b9120863bd72916f1da0aa807f5e0884e0769674

SHA256
e01b9c93940bb29eb20529bf13bd956e3cf5f16e0692bd480f4f4cd174e1ed74

SHA512
3ea1a8ed50dc4a83e044d0da8bce1bd8487b8c737e1a782081a245922c7e090f3bfb071a2f906419c8235b30ac7266128b476ebca8162ba690de43ad1397313a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9841db649dc48710d10c60d5ca8f343

SHA1
58e3f744dec53c95cb42fe5465060a3814e2d3c0

SHA256
ebe7db9c11623a2a706177076ba46c82e836d33e8f8db0fd10d7595f5b86ecb4

SHA512
029cdc38b1a1e4fea34f87271d98083d5d302658c50027068091f37eadc77ed3469edef2a16cb71eee79aeb5aa8553a56a92a1c164122c2fe072890e2cc7ff05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6837e1f0b5c65d45ed3432917ed8ba27

SHA1
ab2a09df012d156f1eff6abc1e68b2de73791efd

SHA256
d059be8fdda0cca56d704f43490ea2fe8838549199190eed85119149b563d5e7

SHA512
c398f489fef9f7870d980ef342e2de4ad2b1a44db1daa3764716f25bad27e489cf176e0e633ec5389be29498680a2de0e0c6f8627dce409d4e7362ae295961f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6f92c9c205d31f205ae27259e5b06e4

SHA1
6376c8603d121e8fadd054570d30fdd142d69579

SHA256
e6406dc644c13524812c26d2130735f15dc16e105d8b4c38236703fa1362b87b

SHA512
1183d93d22343e9344eddd2251ebcc722164e7b03038076455dd42203df253463e5d1480dc8e1d857c8c932a84951c5a383a237103fd21e3efc5443ec2348bc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6189fc8d8d8d825b1076f1434f9810df

SHA1
e79eb3873f65f50fc79626934d85d02473d62258

SHA256
8ae993e580a0a4606d134532da930510e6c31c08fb9b7e64b7c6cd6accb0c1eb

SHA512
ca1b39aaac3a76bbfa376fc7a1c9d95377f233c9de88decb57a35c8c24f08f39fd09c3b3a1589b81faf8858dce776595d3ef91b4971c0d618bbe67e54efad8a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
212dc7503ec22be472ca3cd33e191eb8

SHA1
13f75b91a13d8229bc406c610847798d382262bb

SHA256
1c65fa48dafd0ef85d688ae9ba06e47ae60f6e41bf563ed4e2c8ac9f50cd0d53

SHA512
967017382038ad95c4946dfb00b908a5af7123c7daabba040171ae135ecd7c7c3596007378bd4c87f5f636930cacef50f8bf837dfd04f427471a1db7af4b1a5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2223.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2283.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit