8c4ca143a076c9847824a52918a6b59d15f62d2395a5874bb83bbd7396c9ced1

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6521e21bae0bdbc6cb098f185c29d4bb_JaffaCakes118.html
Size

102KB
MD5

6521e21bae0bdbc6cb098f185c29d4bb
SHA1

b9a068984669471582df10bfdc04c3704ca6388c
SHA256

8c4ca143a076c9847824a52918a6b59d15f62d2395a5874bb83bbd7396c9ced1
SHA512

1a01ba4f41753e02e588b9565c5f8087e818b4d02db82af90a4692407c49b92e6337cf94a5a48c980a596c073617f3598db74c996547642d3ff9547cf373201f
SSDEEP

1536:770NCtuiGLONPY7D3ovmRhcUgExKKNXo3IK7CBS0dqF9E7HUMFxQ:EC5KTM7dMTQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C85FA1C1-17C7-11EF-8C27-FA5112F1BCBF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422495098"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1760	iexplore.exe
1760	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2560	1760	iexplore.exe	28
PID 1760 wrote to memory of 2560	1760	iexplore.exe	28
PID 1760 wrote to memory of 2560	1760	iexplore.exe	28
PID 1760 wrote to memory of 2560	1760	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6521e21bae0bdbc6cb098f185c29d4bb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1760 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bf82ecae50abe1ce43b8e270f42bd991

SHA1
8446df89dd82ae9121491a644c18aaa858d89db7

SHA256
d7918d0a3fcd0fcc111ae3eb994717a34d1173b03dced27e8e15b3d01de5676c

SHA512
46b6920e4725d6d618c982c12ef8435262e41fa2f04c430253061143317b19135d307462b0e5f752d52109da19b0dbca48924e6f6792b33b7db89b0d02692997

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
363cb3284a3021e198d4f4349f12cdea

SHA1
672c80094f2dad3640f543151a8f981da1bbc2a9

SHA256
04936fb2d432efb380fa1aa8471421b4759294ef139c1cd9d27fb86a1d28bce4

SHA512
b60a4afa2770a017147fe80a54b701b784753233d74aed5f2db36bf8d6c2f400cc58ae5654a325d01f5a14a5347e9f527325dba4315f6b8a880e397162e4d4cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
62ef320040f6e8366f56f1287ffb2f2a

SHA1
af2ced8f66a12f8dd4fe201415ebfe4e450381ec

SHA256
0e2a1759aba17a719f54c3e030d91341fc418d01c4af24ab33b680381c652502

SHA512
7fc80c7fafbfae6e0d7e3f2643e02f93e70158cd3eb64cab74b3a3c849224b490bf5928e900d4b9ca8dccd880ae4229d06bfd164be30ef09c1e3054a85a0064d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f171af4e25d9787790bd396d249c0fa3

SHA1
9294546b358aea0dd8a23c62c7ba7d1c81ee8f36

SHA256
a189b9d645027a885500599018242abeb1513735bc6f3b8f593eadc762005dab

SHA512
5b01db0b9652636a96bc30c4ceafd724b7f801064a6181423399aeb4e77f4791b84f7f49b1b9ab4a88b060595c7cbca85bd42aed8f36d12bc48da9a29d7f5a7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8d4a44fc3d5cfb730602fffcd8a82b4

SHA1
1739e5a5a3cec4208cd1e6af240ffec4253707fc

SHA256
11ffc464d330cf0735bb26b755328126e4b5dd7416d4aba7f8c2946298b90f09

SHA512
22749c9e5b54e672e295a92fc0d34502032920896c0b06b9b3646f5a96e52f57917ef3b8950d65387ee2f6ca0e15ec6e11ca8b23ec7bb558240e1b0f5f98d6a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
732ae85005f1f92b1bc19cebef5fa604

SHA1
2db23f0989d370c534977d7d45d1ea8218b52478

SHA256
3577c5f5c3f420ce5b4337571daaeb71a32eb0e84ad4df60c9bce98b96f65beb

SHA512
f6acad471b0688c19ef1572fba4992b21fe83b21cc89007eaa13cf82d7eab30a04438adff6750016bdc3870d4134d4ed6526ab1ff8e30e08c1d1d16a7a3b90ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a20ad39102efebc1d860195671068509

SHA1
4996d386097d1286809bfde4ca288885e5adae4f

SHA256
62389137f08b39be9353370563c45c062936ee3a91554327222d8ed6e50bdf6a

SHA512
6fb1c192182099e42040a621a94b9177c919ab08956f3f2f365e5874e9a300566e16bb55f9f6b4c533f6055f452d8d8335c6065cd45a16657fb158c224152f9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d60996b4accfe87f86805e4ad64438a

SHA1
6a04be454d38233ab5107da373b58c3f25251973

SHA256
d153170e797473052ea38492c27da43426816d8e6ac7976aa119fb32f8f83dd6

SHA512
bb1a18ab0dbcc782ee862d2cbeb49cc46aeb08b2aa2e46c027b0f4441624c2c98dfeec7970ff53ac7f84abdf20562b6367b230d304a5a9ca27dc6fc202632258

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11519da3ad4ddfd6e165e0dc0da66042

SHA1
ba05f8a06e2474e59110b8c86e176c43f9635750

SHA256
44799e25847c261b2d80e82887f115db58d9e1fecefd792fd419451777de0f31

SHA512
67006f512d0ac8bb9c884f5946e30118392ddb7d88dc699d308d78e84ec2de2c9b02fa96270e3d520faff0b09dab2bbf09def958b8f553f463e8cef0c80511d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7AEB.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7B9A.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7BCF.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit