2ab181410ac7e82e172115170cdc97d61ea6b6615bbeebf1280ef3aa294949ed

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6889c9cdd07faeb6c013c2d29fd3909e_JaffaCakes118.html
Size

12KB
MD5

6889c9cdd07faeb6c013c2d29fd3909e
SHA1

ea8a4c358aff08ea8b261d23a3be34eb35829fe1
SHA256

2ab181410ac7e82e172115170cdc97d61ea6b6615bbeebf1280ef3aa294949ed
SHA512

5f5b1a54d1b243d5b48a7ed5d4c639d62b0cf2625dbcc611943f6f7311491611bef3f2d9393c279eb0e9f039feefb6188d8a4f3aaafb5a127fa02ed198618513
SSDEEP

192:F2zC1OlORJq2xgP/ttjifrR7YywM+GV5kCJ6DPw:ssCORJq2xgP/e7nwMRV5k06D4

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422571983"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C9493E81-187A-11EF-B27D-6A387CD8C53E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2848 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2848 iexplore.exe
2848 iexplore.exe
1940 IEXPLORE.EXE
1940 IEXPLORE.EXE

pid	process
2848	iexplore.exe

pid	process
2848	iexplore.exe
2848	iexplore.exe
1940	IEXPLORE.EXE
1940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 2848 wrote to memory of 1940	2848	iexplore.exe	IEXPLORE.EXE
PID 2848 wrote to memory of 1940	2848	iexplore.exe	IEXPLORE.EXE
PID 2848 wrote to memory of 1940	2848	iexplore.exe	IEXPLORE.EXE
PID 2848 wrote to memory of 1940	2848	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6889c9cdd07faeb6c013c2d29fd3909e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1940

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
64ee7952e03c68c01a58743b04d97d08

SHA1
ef0eb4ebc8a0b5e6641618e8e3f10e4a1f90707e

SHA256
d3924b011f90279ac5f9bc883fd073f410f9a8ba76706f289bbb5785b0fa5088

SHA512
556a079f4523ee7993d09b406e289cb056f34ca7078aa2236763db09fef7c87e0ef6a777bc1ebf4c0b22faa8e8b68f3115783306c19393589a3ca2cd30bb83b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
936ffcf8e4fc69afa0ee37e3a2ebaaba

SHA1
c6ba39c8ff4c3b6f0537b5e3a3d16a864ec0c76d

SHA256
76c105a1e0ddf1f4f44d15deb7afde8b6be7a8d348d63d9545d057c92a82c6f4

SHA512
2e167bf7793800cdbe7715ba0d26dbb8b5d941f08ac2972c08f7cb0efdae2127180c2a48f62bc93f52ee7b2dba19045eb8eb4952a94f1e198a9079461652af6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7d6ead24e5322f9278b4d5305de665e1

SHA1
70b154fef2cc648672e28f220884b17b4d4eed26

SHA256
830e99f17699b94862d51da904793887af90219718ab9af03dd29d4aa3746d4a

SHA512
4ba0bb5e6b1acc063085982ec90a3b75b96f99a40bba2bab0f70546378c3e13efc68a27c7ebd13510c584ef580c5cbe46b81a21b485b1f8346ac1041779dfd19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
c090f8bef2eb6b73803da592ea808498

SHA1
3063c618425c5bc2ed82bf634cf2276b30933661

SHA256
4764f5050877824f39bf0fc7822de51baeacab99c2f772ab6ca829fb0f97f068

SHA512
967f305ee2ad53a7505a8696e9cbd791742e086be9d7e6f9fb9fd39e4ad0c48fa066626ae830f0caedf50c85cc15bed606862574ac40f3c74bc09bf3b154f47d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
8802817e0f93e4332a0772da041f788e

SHA1
e156336121d87cd40a412845cfd693196d8663e0

SHA256
ef1ef53d11c8f8ce3e85022a769f7c6c25a90d4d2d5c6b5d2bcde05457c3ef11

SHA512
e6c01f4623cabff9c121ae71b91764718c9629dcaa63d2299b08527e6643ef11f3088ebef48221a66a87b2b32fe23650e183d8fb651d12a9cf9baaf12e44751c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
602ff951863b7ebf904635b374263306

SHA1
f8d6bfd873d82afe056c66fdd6fb3dc4ecd70044

SHA256
d5728023230f8f6839d519558727b89d84b0ca40aa7bb81ea1e4a2081ef17eab

SHA512
96e674e46b5181908f6084ba28af5888becb18344cf121df79f87bd67f482b54660c84021d2c14ae68f34ec43065357751e40b603dfc06129c72d3ad02adcaec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
9770bb52e1dd181c5175df5720011eff

SHA1
27e0210ef60d9003fa4071d8933a531f2682f91e

SHA256
a520ec67ec9e08a24d563f14cac61d92f0dd2885fcd8bcbeb368996a8dbc6298

SHA512
5f71c13e37fe8a485d285d53fd47e8ecd4b3625dbae44ba7c46d6a46308664a98daae9d17a5f8b34e1cf40c92ec2b0ea3cee29688685a5f3fe36ab47c71f0378

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17F4.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1866.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit