b5d102f826c86fbdea14ae401beb1ac7923828217691336a846ef7e6fbb37401

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79a04c1aaee59b52cf22601d279e3e10_JaffaCakes118.html
Size

28KB
MD5

79a04c1aaee59b52cf22601d279e3e10
SHA1

9595a1559233407af0ae68d49496e814f62b7153
SHA256

b5d102f826c86fbdea14ae401beb1ac7923828217691336a846ef7e6fbb37401
SHA512

21d6bd5d687a3c20163b7afa4c4f77b46d0330d38be9b8926bbd31c4488636a4e048d49b9b9b22a1e8c35353054e4ed26cba15fdafd9a0691c624c0ba77f72b1
SSDEEP

192:uwXAb5nr4JvEnQjxn5Q/HnQiemNnUnQOkEnt91nQTbnZnQ9ew3am6sdoOdfQl7Mw:VJQ/odCsoOgSLm

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422986698"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FB6AA11-1C40-11EF-989B-729E5AF85804} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2876	iexplore.exe
2876	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2812	2876	iexplore.exe	28
PID 2876 wrote to memory of 2812	2876	iexplore.exe	28
PID 2876 wrote to memory of 2812	2876	iexplore.exe	28
PID 2876 wrote to memory of 2812	2876	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\79a04c1aaee59b52cf22601d279e3e10_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4fa6691c298573011bc98bd88eaa2221

SHA1
edbbdec3ae7b1addddc080edd2d4d2cb9bd94606

SHA256
20ab727556839485560e2601cd9909fab8b9c9e764185f242c4b689e95128ff1

SHA512
0c8508a75804b345fbdca1290e469843f6976317a1171589ddc6b4a7743a043638f117440108b8ca4d53d44109ac0ccc091e664da611deabb637eb0ad067a064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01734bddcfcc0d9f294156a9a0c4749c

SHA1
2cc48c5f6ee4a728fa1bad4020514cf23f6fbe48

SHA256
1138d86a53f6fbbb18517baaf2fbc78aeadd047977dd373c34ba41f060ac9299

SHA512
f882243c0ec1065b400bafa9e79367f608e9959df313724ccb7202aca8d0abf66d49d170852964e61e17552682cc8f4dee304e3c97253dd25f9db9e143943229

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1ef8ab3429a93fee3ad841d2a2f6017

SHA1
81c423659497a3edd59c2337176da7c6b06e44c6

SHA256
3b26f45a2cbb9149a20d408b9ad3ba4e896da8ac4f1f7d0cca78bb1f410c4a9c

SHA512
bf02f91c0cfd3192e9be6d9aa3d36eb4079d6c45a6f1c2384d38f2324ff051dff94f815006732298988479da2b3a1784245450efdfda4addbf31f53f5793dad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e5b9e37b4141ef425d0868cc50d81264

SHA1
c85313bbfc79eeff62e0eade27712c0946d0b00c

SHA256
71bcb8f48a52f800897d385f2fbd72a5ce195eb05c6ec6f934b9d68996065f7e

SHA512
ba6c5a16a093caae8a3e597d2972d365a89994ddc14f1ff1b126355ec54ec818194a3b31abdf9fbe9154ca0ebf243892d3ae9146da503a2fee36dc84e41b659c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98e2ee499f5244e8e9086584a3916b50

SHA1
7af75430665cbe40b21362a5c05a3e5f5c22bbe2

SHA256
2df31bf8dc0eaedf775e562a988b9c00aa36aa602f04ae8a75cbbb444bfd2e5b

SHA512
ca0bff76966426cc41709074edd5d4fcd269175818b86389a769356d3f21142afc82d8f8af8c9fa6265eed54c9b9b65b45b43cda620398ed230f3570b1e5becd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
989a9b5fcfe3ef15fe51825deb1c20b5

SHA1
849536ac85655900eca368f58957535e964a0457

SHA256
4e25b65dc6d3d3eee82cdb1fc10c305c06418590763e0a8f99e43690599dbde2

SHA512
19d91bb4cf1fe1d1246254207a7b1e977db39ba6dc2af8bb0f3402cb0facf8c52d75e47b08db42062ca514596c798e913c2626275c4e3d55046be506470c8245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7bd7ef6bf095b8689428bba470e24e4e

SHA1
dce3db91668f273def07f55b4b9144baf8ed8632

SHA256
45731f18c1c1dc07f43d0dad7ed723cdba46a332f534077cd323d43a7bf8e9fb

SHA512
2892baa69b2a91e972cb5959bded667da96031459728a706a59e1b320aea563fbcd22c3407c20aecfddd77d7bb23ed47962b1c3645cef76b464ef88083195c08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1269bc654166cbd114b3adeec74f42da

SHA1
650ba8ef0c569015bca9ec4d17f7f69b42d06af2

SHA256
3007e2bf5c5ab990462baa2abf5c3246151371c0a7ed9a0c70e0e2f0bf618b82

SHA512
4f8c396da2c6d359d51f2137b68f4e60be796e0fc318c6c1b707e91b5c2889272d611a4e6dbf92c6563a583359897906d1d2208581fff94910cbd75bd3d3edc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b297cf10c7a024d76838a92b6cc41f59

SHA1
bc14cabe4327fe9d02c66bdef95776b2ff762e98

SHA256
9ec80197361aea807d6e7b691746653a550d9359d8ebca5b0232a9316cfc281e

SHA512
6845224cddfe4d272450a033aefc2c6569056da11acb0a00854dffbe6f1ab573930083276afbce73d6f4be7ce7102736762a44525bbcfd08277a94b9d8a1751b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8F95.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar948B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit