e10812eb79960333f1bbd8e44a078b9138dc3814a55ba9a528873ed28b93a6c1

Analysis

max time kernel
148s
max time network
141s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6898a3acc344432964ebe4d4e9df8a93_JaffaCakes118.html
Size

119KB
MD5

6898a3acc344432964ebe4d4e9df8a93
SHA1

acdc77693ad7177fad0cdff4ca7abe39c8aaac36
SHA256

e10812eb79960333f1bbd8e44a078b9138dc3814a55ba9a528873ed28b93a6c1
SHA512

7d1450f07a876d3f0891006b6aa196eae78071ae15017d46029b4eb9df590492067bcb925a7f70f6b16dc23c7dbe4f38c08a3a57217711e350503247a479becd
SSDEEP

1536:SW14sV5FyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:S1sV5FyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4FF02EB1-187D-11EF-8EEA-EE2F313809B4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422573064"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1364 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1364 iexplore.exe
1364 iexplore.exe
2800 IEXPLORE.EXE
2800 IEXPLORE.EXE
2800 IEXPLORE.EXE
2800 IEXPLORE.EXE

pid	process
1364	iexplore.exe

pid	process
1364	iexplore.exe
1364	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1364 wrote to memory of 2800	1364	iexplore.exe	IEXPLORE.EXE
PID 1364 wrote to memory of 2800	1364	iexplore.exe	IEXPLORE.EXE
PID 1364 wrote to memory of 2800	1364	iexplore.exe	IEXPLORE.EXE
PID 1364 wrote to memory of 2800	1364	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6898a3acc344432964ebe4d4e9df8a93_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1364 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9dae9351f1c99119309a971f47951dda

SHA1
2b93ec5867097afa2596baac3b59bb8ac5c439f5

SHA256
b483c78b974bdb2ba00dcb206a05fd43b1fdb4070ada189391fe4ced5b4a142d

SHA512
e992faf16351cee24e82ebdbee003c4ce590f4fe392eeca95fdb606f2882a43875010f0a715ca93543f7ac7f580efcf465a26169fbfb4cc39e36dd70e236ff04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8fb8dc192a7d1169dd3c603d1c47193

SHA1
13e885d424b0fe4326dc45c6b54e78e934443c31

SHA256
ecb0ff54d09207719170acde4c3bb81d53fe5c59984b872615d849a8fceac672

SHA512
3ed57eb523c702bc2c8d8df629b675e454808751fe93eb8c89e160c4b04943581d20c2e09fe8ef75b10ff1eaf626c1f18ea19f64c5399018226a7ba6c98dd037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1615726805edd5317b943c7d55d6a42b

SHA1
8537e8dc32eb6e7a6d7a1847a7b8c0679dbbecc8

SHA256
141bfe550bcb8026abff3a27bc4ebfb8ad5cc6885b27352a3d1235ee64d3decc

SHA512
4a093d3ab6e15a2c4772894dd485c7e7e828ea52fa1a5c0997775195ab23e6d7ffd097a72653d63af48df9dd8338db7b6141ae8454796202abc97c03d3c0405e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d546db6ccaf3ccc76f3fa15448610344

SHA1
d52bbb49abfc58ec8f4def43c83cc98666d9b963

SHA256
c66cd80bcdfdfd6090789c5f08d147345e95d3a05a6acd5d1b4685c81116968e

SHA512
3f0e4653c2315ada87e9c58b3e92659595818d65b0f806bf4f0c4ac6f7ec46c773a73c145eb8e95e7b7ddae150ddc400df6ad6df4c909fca42ecf509be9f9eec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ce3a8468b6522c18bfd9babf1d258bb8

SHA1
4830fa4c068cad6f1f6fb86798d95c27f927f0c9

SHA256
f76b2e8f2f6acc93ca399b10cd2591cfc75cfd520a6fe77cbc992d641fa52fec

SHA512
31dc46623734ffb4283f5770285c741d1e461f75bebe765e3c8228e21bcae454712ba1c654d2d5b872aa276db6d804f85d27dc0b378c575e9bc823791e562016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d3553e5c9294f7c4bfe0c51d7b2feb0a

SHA1
4722c68b43146bb6dbbfb87ed28154163a49851b

SHA256
3900fc14f588245ce82a86092c23c190536ed8cc16d6c9afe329d70b47e24050

SHA512
370f0f2c9d3b5dd9e4d23a1b6d045f742b6d5c826e297c6a7b86ae53c4b4487c267763b1c426718a6958d22cacb04dd4d8204b16ae357fe922f58d0331b8773f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4eeae508271e15db7897d8efd58e7322

SHA1
0ad6429e9d458fa8ca17765c2b8a97ce51a67f70

SHA256
901b16ce31b227ea8d8cb8f27072e66cc78dd978f15b8c3cd9c40016629a8cb6

SHA512
e1a87170e806a323105bf3fe33177d06ca13cf1589f3fbf491c7fbe0a011019fd5d5e6766126da5fd671ab1a7c545b9b1e4aa2cded68fccb78b42ade3e3b6d6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9b20194a9f69e4c4f2e39d1bdfc88fe

SHA1
b55a334c26686ab74f3ca26dde1ae337bd2e94e4

SHA256
432791483b8723f9ea9e1091c3c7557af9c5478a4a5920026d9770e193657e4c

SHA512
403b35d80683277f7f07b137791cca4274ce9fcb79fa2c45462da9abf0c1abedbaf587dcabac27f1cf577d16abedbb89be96f3a87efa224a8703b4833394f0cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b2bef9138d1e0caad2c9af8734f1495

SHA1
f2e29af1a2c99f796802528862ef776ceef4d5c5

SHA256
0077d07dd52f5fe45250dba968877cc6fc8c05a25f0aa32efed3823196f5b8a4

SHA512
54e07eeefdf2fe1fa617b8c4bb3917b008eae707722a682b7ae0930795a8631b39b8d5fdce54dcb5fef16496f938fabbfb2dbe597d4bb9260028ca5be559eecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c800d7f1492355f713beaa919534c75

SHA1
7712c45fad34135ea60056e11f3f245718962605

SHA256
2812aa924bef4e9f43dc89b65aede89d2f1d872826421329446a6c98ef82c155

SHA512
82183b982bb9f8f41eb8e0fec3cb08d98ed0a7b2257751cafa08fb7778ba63cb7ce962aed59b280afa51a936484f2526fbe371033a1d89045dcd5408521f4068

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a8042feec16b841d77204ef8edc10bee

SHA1
2ed21d567ecba5d0373876e195e225f960c23b0a

SHA256
bbf7c705c551f818f16907dd7ca716b2684389849fac524af3ab952c8026c008

SHA512
addcb43c479323f7d496a9a975704e50030c127805df4c12debcca5f6278830b42ae14235b0cd1cceb7af49c8c180587499f49d8dd20f6213fe3725a6725e89b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A0B.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit