776bebd3bcb4e4ea7f94b5eed0f9efd034899b19277eda90cc02b0f01d136b09

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6864633b0f6e71154f75e1de1a91baf0_JaffaCakes118.html
Size

18KB
MD5

6864633b0f6e71154f75e1de1a91baf0
SHA1

d5f1655de89a1560a5907780fc8c56eeaf9a579e
SHA256

776bebd3bcb4e4ea7f94b5eed0f9efd034899b19277eda90cc02b0f01d136b09
SHA512

4185dc7df86d44cc7cba49c480d52dbe875fa2d46a590be67416faa647b411175d52c9727dbf785e1688fb7c11e7db59c2af31d98dd555ada3f0d1bbb5480867
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI04OzUnjBhCk82qDB8:SIMd0I5nvHnsvCnxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422568831"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74F9FA61-1873-11EF-85B1-6A83D32C515E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE
1216	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1216	2252	iexplore.exe	28
PID 2252 wrote to memory of 1216	2252	iexplore.exe	28
PID 2252 wrote to memory of 1216	2252	iexplore.exe	28
PID 2252 wrote to memory of 1216	2252	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6864633b0f6e71154f75e1de1a91baf0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2282d13255807391a6b51e033ef78202

SHA1
fa3a481c8619dc8653ea9c4d8f6115f88563cf3f

SHA256
6ff6af1ea8c4814bae7860c9210e2e87de014ecb6826cf43e22fd5f8811eef0c

SHA512
23ece873ff9342b3b196e3a34556a8ed39e5926bceeedd0781a3c23279c113b6b20f686cba9bc925e427a295c2409c0c172d84335252c78ca260354a798cf566

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edfc03890f7d3ca378784133a9380b11

SHA1
89fa29be20168ee2495457b2de088b35df793f1f

SHA256
109a94c345d95464d2e0093ee97dc2904be10df5a46fccb494faa40f3ce8c1f4

SHA512
06d57a5e6b08c153a865c1954b9842af526fe605a6bc92efeb6e25840ec84ca2a51b97442b759d666d56c63732ad4b2b9d5bbc51ceea11b977eecd0ed40da8eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce1708c3da1b656c8c5c57636f629e55

SHA1
cbaf7737e8e424d3e52579d7d23629ecaa0096b1

SHA256
d4198dfa3dc4d58b06dc5c769cb8b0f41c62e13e0008221e1e71dce87b0b761f

SHA512
38ac16dd3d8d9cb23747d7ca0737255746ff28cc8c32afa9d04f08e538942ec41ebbd9c81215ef7597d1db6b4c56d3b7b3fc780d4e9fee9ccf4f7877c9061a52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93e6b13f6e5cb569a99cfd4f0d104c22

SHA1
e6b750c511b62e4cf9e36cea03d19ccb7b4b7758

SHA256
c46d3a3a62c2c4697cc0de12e1a6a56b277189a3ea166a146c99054fd941b9c8

SHA512
446ec484a89b40564f551ed537cbc79071117295d36bf71cf1d2ce231f50fef4ed235f6a44b66517928ab85eb9d5ee1c46d525297afc1538350faafdaa9b26af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
edf3eaae80eae523ae132cda0d3edfd3

SHA1
5f6e084a678e458d7689f2c5ce98822dcf74d85f

SHA256
5405c1c20ba562f5ff67ce58c75901db6e64d74e5a4d6d89d076cad945a5379a

SHA512
8ab43088136fe79c1c8c0815d7e9eb44f83c60419c0e3426e7a999cdec33a5008d6dd33139ac56da83581acc60e70816bd07389d33e0fa994e113b63c47afd76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f29605283f4bd2b4f94d67f9a3aa433e

SHA1
c646d3e12ae45b97b5f2668d6fe4ada40a18f338

SHA256
f426c017255df35ffe589085aacd338fbde1e46455e031124534caa0d196a9ef

SHA512
22baf5611fac98293976b86828d6ae6922e4b6bb77475ed669db8307720ef6133ca42770a3ad310f61be67b3d03e7129f4860d09ecca66c36e5d84984cebec06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
09601c9445f2ee1b28c1dce6a2d5f5fe

SHA1
a122a5f9271beb71a063da980e03e25cffb409dc

SHA256
6361568d63506a556fea16837667f2a54601e14b1446b15f7e28b4dc05b018e2

SHA512
c67b9a9e8b3b6161adc78aa7d82989906206c20624f912452754d5082f63f8676261a473ea1685e0a7784b7b33422e8172113302ef27d7892020fd0981af6914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94de22699a3a4ddde3d7add5de24d5fc

SHA1
d7ca703dd241836847d831505e9df08fd623ebaa

SHA256
98723668da70146229aa1fa167534590e500e87bbd0a77d08962d40cbca95206

SHA512
4643cd0bdebc116045d0147f6162d8bc4409ff8c439d8850470a9e5af7d028abda34f2ab6fbdbb4def05cbb1726ee5a571fcd5f5af4135f5136ab351841f3573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1712d5f373b2cef8f960af5562caf36

SHA1
841276cffe18149e39dec206cff802afb63a1270

SHA256
044c055b0f9c7f0d08a0cbfc50b46408f3487f1354a3c3084421c75b08ca8a40

SHA512
e9c61dcf8bc8baf698ff295ea106648a1137a8ce15261185aab0ba507039261e3ac4420b26e7d2d3c0e9817a82714bddd7a6682e7aa9062716b95912d801ef4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D88.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E69.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit