eea1f880c07266f4a51c8a9578c6e86dfe967e3ab141a0860cbb6ad9b78dcd39

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6909e51baba4ca89ff11faa6cc4602de_JaffaCakes118.html
Size

18KB
MD5

6909e51baba4ca89ff11faa6cc4602de
SHA1

0c1bef38cd65b5aa38e7a22b47dcf522cf466527
SHA256

eea1f880c07266f4a51c8a9578c6e86dfe967e3ab141a0860cbb6ad9b78dcd39
SHA512

213ced7148cf695baab3c58ac6c812c8fbb703cb04af209eec747a623065a4905778395af4eb15f3ee0957ce963d46bf0004b05da7564247e1350cb55a1a0ac1
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIL9JNht4o7bDr5ApOGzUnjBhAKYk82qDB8:SIMd0I5nvHVsvD+xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422583359"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{483CCA81-1895-11EF-B73D-E693E3B3207D} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2500 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2500 iexplore.exe
2500 iexplore.exe
2508 IEXPLORE.EXE
2508 IEXPLORE.EXE
2508 IEXPLORE.EXE
2508 IEXPLORE.EXE

pid	process
2500	iexplore.exe

pid	process
2500	iexplore.exe
2500	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2500 wrote to memory of 2508	2500	iexplore.exe	IEXPLORE.EXE
PID 2500 wrote to memory of 2508	2500	iexplore.exe	IEXPLORE.EXE
PID 2500 wrote to memory of 2508	2500	iexplore.exe	IEXPLORE.EXE
PID 2500 wrote to memory of 2508	2500	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6909e51baba4ca89ff11faa6cc4602de_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6096e3fb17f88927340f0871697d5251

SHA1
51b8fe3111f31cbddce702ca93b8adede23771ac

SHA256
f06481a81339569b7c60a35574883d6ef4059c31d0fbb238133d5055a882015b

SHA512
78154ed1dea5df5a7736652889304eef31439e1f39b82f704ebf0b778d7afdc542f7fc3ea4bfb19e203d70215e6d3a8be37dd21de504fd9ffe80e6fd57fe3fa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3958d3a67dcb7e65e36b44bfac982b5a

SHA1
acbb4e385ab606ac64155cfa9bbc9aa580f7e7a7

SHA256
281760c6465d6981f800292b2c3156084a3a99e01d71a6099fb470a1d9285717

SHA512
3f6e82c5703248f6054577622fc986d28620123caad2cc6cfcc2db718af12af9eaca6d9bf4bc03ae4bbf0caf432cfe2f833cb2272d0ce47891f67b48d06966d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c79cb58159d8d13283ee80499afc8160

SHA1
6ce9cfaae7c563de5c951491cc2ad354d0fa5118

SHA256
ff84b9bf597334debcab92a8be3f6825008bf2774e16cb2d7fd41a0dab33de5e

SHA512
d18c3bb19771b3b7b6072d05e8f4830bea9f8c131bd45661b0804a82d40626998a4defa7b869e47a55d11786a979440a680ffbcbb02931188041129710148776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2b40b2340985c666ce655263b1c2550

SHA1
7bebdb657a0b6b2fdef54bab74b7ef99f3c0346d

SHA256
13f14f4b61bfe631b3831a58507b87c6a01ab7ccffd2639ad058f17e25939387

SHA512
abb8403091e1c1f549953edf98208a447e2dcb297dc9ef9b273b5453922fe66cd35a7f8b3cd703b2ffac4697d2785b754b5522e60941a374df405664b5b29302

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28437ee90ce5c3622689798d5ebdba3e

SHA1
668976b2c79a37afab8287bfadb2d741a6e5f435

SHA256
02f8f5b11f994cf0287963ea75a1261d3dc2393125b2539dbd0c226764300063

SHA512
d8ba409b725d21ad34161986ad45c6b8d875ae496dc8dc4f13db30faf57b01ccb3813ac0167dfd8a4efb2c9b4abe50a33f39932d7ee8cd8b610865a6ceaabbdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e209eeb5da7ba9e9636344267ddfa612

SHA1
d0d07539a9c5241ccde9d6da7d7103dd6af339e3

SHA256
c2d1ac494a355100632b29597f3bea347140e5a1de96a3c6d07cff2f369e4902

SHA512
026e7c51ff84a34b3764fdd08b1beb2ab32f90e87d9a1213fdd3e3d4727f8cc2e6f01157d422f10720a55abd93de3a695df1b79b1b802e16bf52f5c9579a4993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7fc412c67fa0e3415fe5bcf0fc0bfba1

SHA1
b2adeee104d207510490149fe9b0f39b8adcc14b

SHA256
221e3d0041206b13ca7a679ab697be1bb5f6af65a0183ab005363f28a02cc5ad

SHA512
c08bf08ad469191f4e1cddf693db9e1f8c5da94786e3aa3af8a542fded2d3f36a9a776d33630c111f79ce74e8ee69578080e6041b36b2aa2469b692223a51ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9a4d5a6e640a5db12fb1fb8745bead05

SHA1
e7178493846a1fd6284450ddc934e1cdd02e6c41

SHA256
bfcc5b418b5ea7bec9d037169c98e895b4c196aba01d24096a45e5003ec6e0b3

SHA512
195003d8d2eeb519bd07dc783edc529558edb5146dc315852c43a36959105edc7e998090d9c7bcffe038fb15c74a07d8647b8d59d13b88428006d57c953fc564

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d5256e611555bb32fed95fdcc22ef22

SHA1
6941d6c6a43ba68ab2b1b310acf8b0cd26c2c687

SHA256
5b83a21f90e0ad5fd3c7076dd76d75b8f55ff2cf67a11113ac4e97b1bcf8bf18

SHA512
8540a3107081604458b4d0b0bdccf687eebfb24a9669044d51cb6b8381ab4e7bbf9b9983c75fc149d9df6f6fcb18bd9db1122df836d22222da71c8e71bfde851

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1122.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1213.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit