76bcf42ebab9d3994554a2a50bac9f718aa6e923106a1e2a58fa330839639b8a

Analysis

max time kernel
0s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99a5c0ac0764fc46a87be3edd8c1df9f_JaffaCakes118.html
Size

96KB
MD5

99a5c0ac0764fc46a87be3edd8c1df9f
SHA1

cff2f14fb6be4f5d91de799ac2bc7c17f49d39e7
SHA256

76bcf42ebab9d3994554a2a50bac9f718aa6e923106a1e2a58fa330839639b8a
SHA512

4ab2f2a04b162c32ec93aa187a999bceab8c0e02a9182be3854275b6f7834d801e56c8e4000b33f0a41f42e87a8019d39f689362956160d7a53ff680012e0823
SSDEEP

3072:sbxWw6RYii271XiMQwJxOWokSfle6VgIsaaFFR8r:y2x0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F3A4A31-239F-11EF-8E7B-D20227E6D795} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1156	2240	iexplore.exe	28
PID 2240 wrote to memory of 1156	2240	iexplore.exe	28
PID 2240 wrote to memory of 1156	2240	iexplore.exe	28
PID 2240 wrote to memory of 1156	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\99a5c0ac0764fc46a87be3edd8c1df9f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ba82782db5fb67e9350b862823a4f25

SHA1
c51007d3697c89f80e0e03b0ed5dd010c79b3619

SHA256
df3272b00203fdf1c0f52d25e122785073b79fd7e3aa427f12ce17ff2c6cee02

SHA512
50ecf9e26df172c36147dd5e4b7b230bf9303775a3580534cc6bd31e21ea43c22b36c6b991831aa8236a988416b17d7721ee333f058ecc9589fc6709fac4939a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ae5a0f40752cb078464a8ce5b2f8917

SHA1
2008db4d7b24154ed7efdf1438e9b4ce8c78b037

SHA256
e52e6c387dac35ab030a1ab9f7f01a9326b1ce1f76fc0436cf3be0c6d4ab0563

SHA512
d6f1804e99aa8aafd4046a54bde1a1cfbe913272ea877a70d4680f6f1eb8b54468d2f4d17a201dc0da679252b98c5f946fc671c97fc5ff6b01fc1e99aa096f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba7b5f3642cc352f10ca561f6f3038a3

SHA1
18c3d795ff21ff77eaaf0ee490b6a3c092c2b1b2

SHA256
c60277734205af93cd76ddad29adc985de418d6b56f41c39a801955f1b64f616

SHA512
5007c0640afeae8b0759d237337bfc076ed65962c74ce8f6ad4d5eb851869f60988b49cdc8b713327d9366ad36fee2c3d724d0fd64b9fe92415357dcb946301d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ca9257a4d81ca7eda85105b665359b4

SHA1
5539e659d45a6496000df8de2c59e3e05645479f

SHA256
da55df6627098be3bfbc10539478db547baae8061983fcc37a43cd415d8096d5

SHA512
b2388ee362d4b0e2fa7b554263a75c5c50da825583e629803474ba5fedabc5d8702c73b6e156fd7030b8de90842cb1f8fd94f0bcf0e371efc26d9325a75105d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c20730eae987876763cb8c96732ec10

SHA1
6d9cfcc50cef7a136a8a4b81345f189a7e024c86

SHA256
735d373780b24167bc8f75a45b7f7fd48d2c3054a4fbcf04994dcbebc161538b

SHA512
2c0d886dc40c5d47d1dbdf1e5a2adac1f08ca9f2f2f61c34595e72066724dd1d6fbbcf212777cb2327baf5265bbe47bb77ea95eff584642dc0f30c93f01f6fae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
422c7718342c269c3141bba0c54ce620

SHA1
a9c8e1a3cc52752e4036c99b788ef65e8550e331

SHA256
e3d0d0b596b84ed04ff2ebac3f21cbab9267b00006bac2c685fe54b551b54b38

SHA512
fb57dae5272d8ceeee1d9ee127b4f396b6847b9a1ccf72688ce2fa257bc0aadd955c0323919053ea777f9b33a008be7e7983ccbd8bf3ed3342b7c948d6e7746c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b40bebd212cab00922f8183bd771897e

SHA1
8ade615549c583e5991f06e9f8354dea50e207f7

SHA256
e64b470445d1e8683d4b2505868265472671e2b6d044c7d12581344ffb444bbf

SHA512
c1dbe7797695ab6dbd3eb5f73264bb8b6abcbfcd86bda626c7921f03da73f2c1a45ba480b6f243e2d67612bb493e9510be7bdb808b1b8f23fdd6484a8b87c083

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a7f4701db2e6988c958e8fd93d86f2a

SHA1
7942be0495f92f404e4d9507492ca96a7bfba97d

SHA256
dbf637bdbca385e3025daf56a3fbb876facd8cafd121b4aee1abacfec613c652

SHA512
1cbfef7a0a6d9a2b5fb5b7c3e06b2879ae1feaaf31dddbc17ccba64057d5103e83255e3493e039accf480ce7ddf80cce002b26196b1fd7832f9f6b1f596a1b9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca99af49114e6eb671312a6b4ae8fd08

SHA1
64ea33ad029bdc422e7afd8baee11c6b4eef63a6

SHA256
c4f928470e109965446e8eae1c004c318d3969585697fad9ff754105fa6387f5

SHA512
d8b5d961fca7a0652b0c4a77e5b94a5e070a22593e97ce9f8d18ff1aed4a39f26e710f5d4a444ee43e12deec8e54f434e39e6e437c72f5ce3b8d8e03a434e899

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CA5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D79.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit