6d268cd0806f4bf3110145eb61c28962559c50ba3938d177f8fbe95327f9ee64

Analysis

max time kernel
149s
max time network
139s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

639033977b3650b231da8f34131d79c6_JaffaCakes118.html
Size

18KB
MD5

639033977b3650b231da8f34131d79c6
SHA1

5b55ceab75f0dbd2a821498889e541c4633a8fb4
SHA256

6d268cd0806f4bf3110145eb61c28962559c50ba3938d177f8fbe95327f9ee64
SHA512

c092b9b88008b0b1399a8bd05363f12d352fe1c2d35be68b19cbb52cbb8e6721f4fbb542f11f7c3889d7ef962ac546287f496cf1f445d6d482ab3aacd17e643d
SSDEEP

384:SIMd0I5nvHt3nzdKQAAohcDOnsvPHXaxDB8:SEVTA

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF631041-177B-11EF-B4B5-5E73522EB9B5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422462414"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2924 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2924 iexplore.exe
2924 iexplore.exe
2568 IEXPLORE.EXE
2568 IEXPLORE.EXE
2568 IEXPLORE.EXE
2568 IEXPLORE.EXE

pid	process
2924	iexplore.exe

pid	process
2924	iexplore.exe
2924	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2924 wrote to memory of 2568	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 2568	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 2568	2924	iexplore.exe	IEXPLORE.EXE
PID 2924 wrote to memory of 2568	2924	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\639033977b3650b231da8f34131d79c6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b437c55a44a389b22738a93c4649539d

SHA1
b0fa2b9c1f6a9b4d666f7149c943216a8057a843

SHA256
f61384afac365b71161da8c1a7b0bc466c67dcadc43b3aefe1f4c3c338e0015d

SHA512
979df7ce7392ca64b4de07c9b851b0ff8922e24bbdb27410233303d86578ccbeed1f524cbc9c7713f5771d5ecbe3646c66bf1daf3c3efdd64ec529e18d57d208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f88a69fe148a4a076da439058af8191

SHA1
6db482c17fbf79f6f7f6792de14acc9f56fd55fa

SHA256
2727986a727c4281176ce4a70f211735785c4fcd020a14d389f0ae91fc5bbd95

SHA512
0281a233ee532fc636d76bd040e1f61452c0149ac40f0d5565987f72b2e3caafa8d98223d377a943a37c0e22dd81d86bebd2d1f83e26d23fe25b60aeed7e99c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73cd84a8798ab4b06789e12eb961a05c

SHA1
59634a5b45968abfb1ff68b5e22490c48cbf926b

SHA256
537f653d8c654bf17c877c6202ca3d291412b5dc5c86d12080e8abef6a979b0d

SHA512
957fc4df9a02fc3cc666b1c66b246a699722e29e99061b3ef238274ba58436d19c8a8a34381d84bd512fafb61502550fad13e6e2eb4f622d6b83d7a5401040b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12406d92be179777f25edf346d2dd8c5

SHA1
0eedafc477e1ba200b79d2446c7bac7054bc56cf

SHA256
d313116c17a9fc6138fbe718991535f29efcbb4f145485c90c563b338845e5ba

SHA512
575e9bfcdbc7e6ce284f79cf610a6eecf20e1fa6372bec9a989c5b89572ef12fe5a269727f7dd97101f92050dfa9aa720f8489851ff7400e494f592b7af6e445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
900df52971a6c803409bd911371eb4eb

SHA1
726e0b93ca0c944f4ae917c84ed6ef2218879dbc

SHA256
d8881611938a59461f82bf7194db215eb99b72aa0eb0e2b6b31d849be9eb2628

SHA512
433b275c3c7a306711ff8389c2953149bd982903aae97633a501a55b1ceba06318aee8094e9f036ab073d1b0a084c83d45f2a69da01acb5ea5ebffff865ddd00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3972a8dd405f200f5118cb2d0fe16410

SHA1
a7d27cf3999d634c790c69209a33fcba75be3095

SHA256
be4d1de78acb8cb1fcf2fe24fc7ae302bce21a927d9b1cbf0371ed0ec0230467

SHA512
4bf31b1772e4624839e74f49ff679c57d27114f04706a5bf4c8dcd464979310e73bb10ba2df866418b3e4fc2670cec6ed9e384133ade5f5d7ff1a970adcc705f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3640e5cd4c37b6d89d5b394e664ada93

SHA1
bdc1e826de638fff585adee6acbaf00d3da119f0

SHA256
d2d0437149822a1c10f587884e29becb352723ba1fe329d8cf3043cc0ce3a3bb

SHA512
b36ef0a1737cfa382704673717f756ed0c9ca76b4454b470056c43893ad847c3ab0c4eb03d81e9c2b07ab9cf4df19a73d57e9da725733cd7df71bbab364bbf69

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2158.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2239.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit